@kenhkl/agent-moss 0.10.4 → 0.11.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli.js +472 -82
- package/dist/cli.js.map +1 -1
- package/dist/engine/coordinator.js +463 -73
- package/dist/engine/coordinator.js.map +1 -1
- package/dist/rules/user_rules.json +77 -0
- package/dist/server.js +467 -77
- package/dist/server.js.map +1 -1
- package/dist/static/index.html +104 -1
- package/package.json +1 -1
|
@@ -0,0 +1,77 @@
|
|
|
1
|
+
{
|
|
2
|
+
"sensitive_actions": [
|
|
3
|
+
{
|
|
4
|
+
"pattern": "写入系统文件",
|
|
5
|
+
"description": "写入 /etc, /usr, /boot 等系统目录下的文件"
|
|
6
|
+
},
|
|
7
|
+
{
|
|
8
|
+
"pattern": "发送外部邮件",
|
|
9
|
+
"description": "通过 email 工具发送邮件到外部地址"
|
|
10
|
+
},
|
|
11
|
+
{
|
|
12
|
+
"pattern": "危险 shell 命令",
|
|
13
|
+
"description": "执行 rm -rf, chmod 777, sudo 等危险命令"
|
|
14
|
+
},
|
|
15
|
+
{
|
|
16
|
+
"pattern": "修改全局配置",
|
|
17
|
+
"description": "修改系统级配置文件或环境变量"
|
|
18
|
+
},
|
|
19
|
+
{
|
|
20
|
+
"pattern": "支付操作",
|
|
21
|
+
"description": "涉及支付、转账等金融操作"
|
|
22
|
+
},
|
|
23
|
+
{
|
|
24
|
+
"pattern": "访问密钥文件",
|
|
25
|
+
"description": "访问 .ssh/id_rsa, .env, credentials 等密钥/凭证文件"
|
|
26
|
+
},
|
|
27
|
+
{
|
|
28
|
+
"pattern": "网络数据外传",
|
|
29
|
+
"description": "通过 HTTP/wget/curl 等方式将数据发送到外部服务器"
|
|
30
|
+
},
|
|
31
|
+
{
|
|
32
|
+
"pattern": "curl * -d *",
|
|
33
|
+
"description": "使用 curl 发送数据到外部服务器（可能为数据外传）"
|
|
34
|
+
},
|
|
35
|
+
{
|
|
36
|
+
"pattern": "curl * POST *",
|
|
37
|
+
"description": "使用 curl POST 请求发送数据到外部服务器"
|
|
38
|
+
},
|
|
39
|
+
{
|
|
40
|
+
"pattern": "wget *--post-data*",
|
|
41
|
+
"description": "使用 wget 发送 POST 数据到外部服务器"
|
|
42
|
+
},
|
|
43
|
+
{
|
|
44
|
+
"pattern": "crontab -e",
|
|
45
|
+
"description": "编辑定时任务（可能用于持久化后门）"
|
|
46
|
+
},
|
|
47
|
+
{
|
|
48
|
+
"pattern": "crontab -r",
|
|
49
|
+
"description": "删除定时任务（可能用于清除审计痕迹）"
|
|
50
|
+
},
|
|
51
|
+
{
|
|
52
|
+
"pattern": "* | crontab",
|
|
53
|
+
"description": "管道方式安装/修改定时任务（可能用于持久化后门）"
|
|
54
|
+
},
|
|
55
|
+
{
|
|
56
|
+
"pattern": "iptables -",
|
|
57
|
+
"description": "修改防火墙规则（可能用于关闭安全防护）"
|
|
58
|
+
},
|
|
59
|
+
{
|
|
60
|
+
"pattern": "ssh* -o StrictHostKeyChecking=no",
|
|
61
|
+
"description": "SSH 跳过主机密钥验证（可能用于横向移动）"
|
|
62
|
+
},
|
|
63
|
+
{
|
|
64
|
+
"pattern": "base64 -d * bash",
|
|
65
|
+
"description": "Base64 解码后执行（可能用于编码绕过）"
|
|
66
|
+
},
|
|
67
|
+
{
|
|
68
|
+
"pattern": "curl * | bash",
|
|
69
|
+
"description": "下载远程脚本并执行（远程代码执行风险）"
|
|
70
|
+
}
|
|
71
|
+
],
|
|
72
|
+
"sensitive_tools": [
|
|
73
|
+
"eval",
|
|
74
|
+
"exec",
|
|
75
|
+
"system"
|
|
76
|
+
]
|
|
77
|
+
}
|