| /* * rules_log_yara.yar * PcapAnalyzer — 내장 웹 공격 탐지 룰 * * 원본: Yara_InitRules() 하드코딩 룰을 외부 파일로 분리 * 엔진: PcapAnalyzer 자체 미니 NFA Regex 엔진 (Yara_ParseFile 호환) * * [내역] * 1. SQLi_HighRisk: PostgreSQL(COPY TO), Oracle(DBMS_) 타겟 추가 * 2. PathTraversal: Windows 환경 민감 파일 접근 패턴 추가 * 3. RFI: 파라미터 기반 가중치 방식 또는 엄격한 매칭으로 오탐률(FP) 감소 * 4. Webshell: 단독 문자열 매칭으로 인한 오탐 방지를 위해 파일명 경계(/) 추가 * 5. Insecure_Deserialization: 역직렬화 공격 탐지 * 6. SSTI: 서버 사이드 템플릿 인젝션 탐지 * 7. File_Upload_Bypass: 이중 확장자 및 널바이트 파일 업로드 우회 탐지 * 8. Auto_Scanners: 자동화 취약점 스캐너 탐지 */ /* ================================================================ 1. SQLi — 고위험 (YARA_COND_ANY) ================================================================ */ rule SQLi_HighRisk { meta: description = "SQL Injection 고위험 패턴 (MySQL, MSSQL, PgSQL, Oracle)" attack_type = "sqli" condition_type = "any" strings: /* UNION [공백/주석/URL인코딩] SELECT (ALL/DISTINCT 포함) */ $r_union_select = /union([\s+?]|\/\*[^*]*\*\/|%09|%0[aAdD]|%20)+(all([\s+?]|\/\*[^*]*\*\/|%09|%0[aAdD]|%20)+)?(distinct([\s+?]|\/\*[^*]*\*\/|%09|%0[aAdD]|%20)+)?select/ nocase /* 시간 기반 블라인드 */ $r_time_blind = /(sleep|pg_sleep|benchmark|waitfor([\s+?]|\/\*[^*]*\*\/|%20)+(delay|time))\s*\(/ nocase /* 저장 프로시저 실행 */ $r_exec_proc = /(exec(ute)?\s+)?(sp_|xp_)(executesql|cmdshell|regread|dirtree)/ nocase /* 파일 I/O (PostgreSQL COPY TO 추가) */ $r_file_ops = /(into\s+(outfile|dumpfile)|load_file\s*\(|load\s+data\s+infile|copy\s+[^\s]+\s+to\s+['"])/ nocase /* 메타데이터 조회 */ $r_info_schema = /(information_schema|sys\.(tables|columns|user_tables)|pg_catalog|pg_tables)/ nocase /* 에러 기반 */ $r_error_based = /(extractvalue|updatexml|exp\(~\(|xmltype)\s*\(/ nocase /* 시스템 변수 */ $r_sysvar = /@@(version|datadir|hostname|servername|basedir)/ nocase /* Oracle DBMS 패키지 공격 */ $r_oracle_dbms = /dbms_(sql|xmlquery|assert|utility)\./ nocase condition: any of them } /* ================================================================ 2. SQLi — 저위험 가중치 기반 (YARA_COND_WEIGHT, 임계값 2) ================================================================ */ rule SQLi_LowRisk { meta: description = "SQL Injection 저위험 패턴 (가중치 합산)" attack_type = "sqli" condition_type = "weight" weight_threshold = "2" strings: $r_logic_bypass = /('|")\s*(or|and)\s+['"]?1['"]?\s*=\s*['"]?1/ nocase weight:2 $r_comment_term = /('|")\s*(;\s*--|\s*--|\s*#)/ nocase weight:1 $r_cast_convert = /(cast|convert)\s*\(/ nocase weight:1 $r_having_case = /\s(having|case\s+when|group\s+by|order\s+by)\s/ nocase weight:1 condition: weight_threshold } /* ================================================================ 3. XSS — 크로스 사이트 스크립팅 (YARA_COND_ANY) ================================================================ */ rule XSS { meta: description = "Cross-Site Scripting 패턴" attack_type = "xss" condition_type = "any" strings: $r_script_tag = /<\s*script[\s>\/]/ nocase $r_js_uri = /(javascript|vbscript)\s*:/ nocase $r_event_handler = /on(error|load|click|mouseover|focus|blur|input|change|abort|drag|keydown|keypress|keyup|mousedown|mouseup|submit|toggle|pointerdown|pointerup|animationstart|animationend|transitionend)\s*=/ nocase $r_eval_funcs = /(alert|confirm|prompt|eval|settimeout|setinterval)\s*\(/ nocase $r_dom_write = /(document\.(cookie|location|write\s*\()|window\.location|innerhtml|outerhtml)/ nocase $r_data_uri = /data:\s*(text\/html|application\/javascript)/ nocase condition: any of them } /* ================================================================ 4. Path Traversal / LFI (YARA_COND_ANY) ================================================================ */ rule PathTraversal { meta: description = "경로 이동 및 로컬 파일 인클루전(LFI) 패턴 (Unix & Win)" attack_type = "trav" condition_type = "any" strings: /* ../ / ..\ 및 변형 */ $r_dotdot = /(\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e\/|\.\. ?%2f|%2e%2e%5c|%c0%ae%c0%ae%c0%af|%252e%252e%252f|\.\.(;|%3b)\/)/ nocase /* Unix 민감 경로 */ $r_sensitive_unix = /(\/etc\/(passwd|shadow|group|sudoers|hosts|motd|issue)|\/proc\/(self|version|cmdline)|\/root\/\.bash_history|\/var\/log)/ nocase /* Windows 민감 경로 (추가) */ $r_sensitive_win = /(c:\\|c:%5c|c:\/)?(windows|winnt)\/(system32|win\.ini|boot\.ini)/ nocase /* PHP 래퍼 */ $r_php_wrapper = /php:\/\/(filter|input)|zip:\/\/|phar:\/\// nocase /* 널 바이트 인젝션 */ $r_null_byte = /%00/ nocase condition: any of them } /* ================================================================ 5. RFI — 원격 파일 인클루전 (YARA_COND_ANY) ================================================================ */ rule RFI { meta: description = "Remote File Inclusion 패턴 (오탐 방지 적용)" attack_type = "rfi" condition_type = "any" strings: /* 일반적인 리다이렉트가 아닌, 파일/페이지 참조 파라미터에 URL이 올 때만 탐지 */ $r_rfi_strict = /[?&](page|file|inc|path|url|doc|view|module)= *(https?|ftp)(:\/\/|%3a%2f%2f)/ nocase condition: any of them } /* ================================================================ 6. Command Injection (YARA_COND_ANY) ================================================================ */ rule CmdInjection { meta: description = "OS 커맨드 인젝션 패턴" attack_type = "cmd" condition_type = "any" strings: $r_shell_cmd = /(cmd(\.exe)?\s+\/[ck]|powershell(\s+-[a-z]+)?|\/bin\/(sh|bash|zsh)|\bwget\b|\bcurl\b|\bnc\s|netcat|ncat|\bmkfifo\b)/ nocase $r_cmd_sep = /[;|`&]\s*(id|whoami|ls|cat|echo|ping|wget|curl|chmod|chown|uname|hostname)\b/ nocase $r_reverse_shell = /(\/dev\/(tcp|udp)\/[0-9]+\.[0-9]|python[23]?\s+-c|perl\s+-(e|mio)|php\s+-r|ruby\s+-rsocket)/ nocase $r_ifs_bypass = /\$\{?IFS\}?/ nocase condition: any of them } /* ================================================================ 7. Webshell (YARA_COND_ANY) ================================================================ */ rule Webshell { meta: description = "웹셸" attack_type = "webshell" condition_type = "any" strings: /* 슬래시(/)를 포함하여 c99 같은 일반 문자열이 오탐되지 않도록 수정 */ $r_known_shells = /\/(c99|wso|r57|b374k|china\.chopper|godzilla|behinder|regeorg|cobaltstrike|aspxspy|phpspy)\.(php|asp|aspx|jsp)/ nocase $r_dangerous_funcs = /(system|passthru|shell_exec|popen|proc_open|pcntl_exec|assert|create_function|preg_replace)\s*\(/ nocase $r_encoded_payload = /(base64_decode|gzinflate|gzdecode)\s*\(/ nocase $r_shell_param = /[?&](cmd|exec|run|shell|code)=/ nocase condition: any of them } /* ================================================================ 8. SSRF — 서버 사이드 요청 위조 (YARA_COND_ANY) ================================================================ */ rule SSRF { meta: description = "Server-Side Request Forgery 패턴" attack_type = "ssrf" condition_type = "any" strings: $r_metadata = /(169\.254\.169\.254|metadata\.(google|azure)|0177\.|0x7f|2130706433|\[::1\]|\[::\]|localhost)/ nocase $r_internal_net = /\/\/\s*(127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)/ nocase $r_proto_smuggle = /(dict|gopher|sftp|ldaps?|file):\/\// nocase condition: any of them } /* ================================================================ 9. XXE — XML 외부 엔티티 인젝션 (YARA_COND_ANY) ================================================================ */ rule XXE { meta: description = "XML External Entity Injection 패턴" attack_type = "xxe" condition_type = "any" strings: $r_entity = /<!(\s*)(entity|doctype)/ nocase $r_system_uri = /system\s+['"]\s*(file|http|https):\/\// nocase condition: any of them } /* ================================================================ 10. Log4Shell & Spring/Struts (YARA_COND_ANY) ================================================================ */ rule Framework_Exploits { meta: description = "Log4Shell, Spring4Shell, Struts2 패턴 모음" attack_type = "log4shell" condition_type = "any" strings: /* Log4Shell */ $r_jndi_basic = /\$\{[^}]*jndi\s*:/ nocase $r_jndi_proto = /\$\{jndi:(ldap|rmi|dns|ldaps|corba|iiop)s?:\/\// nocase $r_jndi_obfuscated = /\$\{[^}]*(lower|upper|:-)[^}]*:[^}]*\}/ nocase /* Spring & Struts2 */ $r_classloader = /class\.(module\.classloader|classloader\.(resources|defaultassertionsstatus|uricharset|parent))/ nocase $r_ognl = /(ognl:|#(application|session|request|parameters|attr|this|root)\[|@java\.lang\.(runtime|processbuilder)@)/ nocase $r_struts2_bypass = /%\{(#nike=|#_=|#_memberaccess|#application|#container=@ognl)/ nocase $r_spring_cloud = /spring\.cloud\.(bootstrap|function\.routing-expression)/ nocase $r_proto_pollution = /(__proto__|constructor\.prototype|prototype\.constructor|__define[gs]etter__)/ nocase condition: any of them } /* ================================================================ 11. [신규] Insecure Deserialization (YARA_COND_ANY) ================================================================ */ rule Insecure_Deserialization { meta: description = "안전하지 않은 역직렬화 공격 (Java, PHP, .NET)" attack_type = "deserial" condition_type = "any" strings: /* Java Base64 (rO0AB) 및 Hex (aced0005) 매직 바이트 */ $r_java_magic = /(rO0ABX|aced0005)/ nocase /* PHP 직렬화 객체 형식 (예: O:8:"MyClass":) */ $r_php_obj = /O:\d+:"[A-Za-z0-9_]+":/ nocase /* .NET Base64 인코딩된 포맷터 헤더 */ $r_dotnet_fmt = /AAEAAAD\/\/\/\/\// nocase condition: any of them } /* ================================================================ 12. [신규] SSTI — 서버 사이드 템플릿 인젝션 (YARA_COND_ANY) ================================================================ */ rule SSTI { meta: description = "Server-Side Template Injection 패턴" attack_type = "ssti" condition_type = "any" strings: /* Java 계열 (Spring/Thymeleaf/FreeMarker) RCE 시도 */ $r_ssti_java = /\$\{(T\(java\.lang\.Runtime\)|T\(java\.lang\.ProcessBuilder\))/ nocase /* Python/Jinja2/Twig 계열 민감 객체 접근 */ $r_ssti_python = /\{\{\s*(request|self|config|url_for)\s*\./ nocase /* 일반적인 템플릿 명령어 실행 블록 */ $r_ssti_generic = /(\{\%|\[\%|#set\s*\().*(exec|system|eval)/ nocase condition: any of them } /* ================================================================ 13. [신규] Malicious File Upload Bypass (YARA_COND_ANY) ================================================================ */ rule File_Upload_Bypass { meta: description = "악성 파일 업로드 우회 기법 (이중 확장자, 널바이트)" attack_type = "upload" condition_type = "any" strings: /* 이중 확장자 (예: shell.php.jpg) */ $r_double_ext = /\.(php[345]?|asp[x]?|jsp[x]?|cgi|sh|pl)\.(jpg|png|gif|txt|pdf|zip)/ nocase /* 널바이트 인젝션 (예: shell.php%00.jpg) */ $r_null_ext = /\.(php[345]?|asp[x]?|jsp[x]?|cgi|sh|pl)%00\.(jpg|png|gif|txt|pdf)/ nocase condition: any of them } /* ================================================================ 14. [신규] Automated Scanners & Attack Tools (YARA_COND_ANY) ================================================================ */ rule Auto_Scanners { meta: description = "자동화 취약점 스캐너 및 공격 도구 헤더/User-Agent" attack_type = "scanner" condition_type = "any" strings: /* 주요 스캐너 및 공격 프록시 시그니처 */ $r_scanners = /(sqlmap|nikto|dirbuster|nmap|zgrab|masscan|w3af|acunetix|netsparker|appscan|arachni|burpcollaborator)/ nocase /* Python/Go 등 스크립트 기반 기본 헤더 통신 시도 */ $r_script_ua = /(python-requests|python-urllib|go-http-client|java\/[0-9\.]+)/ nocase condition: any of them } |
반응형
'IT > Coding' 카테고리의 다른 글
| [C언어] Data Conversion Tool - RawVera : rules_log_snort.rules (0) | 2025.12.14 |
|---|---|
| [C언어] Data Conversion Tool - RawVera : rules_eml_yara.yar (0) | 2025.12.14 |
| [C언어] Data Conversion Tool - RawVera (1) | 2025.12.14 |
| Python 3.14의 주요 개선사항 (0) | 2025.10.09 |
| [Python] 파이썬 2,3 가상환경 사용법 완전 가이드 (0) | 2025.10.03 |
