@kenhkl/agent-moss 0.12.9 → 0.14.0

package/dist/rules/l1_rules.json

@@ -13,8 +13,8 @@
       "reason": "检测到删除关键系统目录"
     },
     {
-      "pattern": "\\brm\\s+-[a-zA-Z]*r[a-zA-Z]*\\s+/(?!tmp/|var/tmp/|run/|dev/shm/)",
-      "risk_level": "high",
+      "pattern": "\\brm\\s+-[a-zA-Z]*r[a-zA-Z]*\\s+/(?!tmp|var/tmp|run|dev/shm|mnt|media)(?:/|\\b)",
+      "risk_level": "medium",
       "risk_type": "script_execution",
       "reason": "检测到递归删除操作 (rm -r /...)"
     },
@@ -25,16 +25,16 @@
       "reason": "检测到强制删除文件 (rm -f /...)"
     },
     {
-      "pattern": "chmod\\s+[0-7]{0,3}7\\b",
+      "pattern": "chmod\\s+(?:(?:-[a-zA-Z]*|--)\\s+)*[0-7]{0,3}7\\b",
       "risk_level": "critical",
       "risk_type": "privilege_escalation",
-      "reason": "检测到危险权限设置 (chmod ...7, other 位含写+执行敞口)"
+      "reason": "检测到危险权限设置 (chmod ...7, other 位含写+执行敞口; 含 -R 递归与 -- 分隔符形态)"
     },
     {
-      "pattern": "chmod\\s+[24][0-7]{3}\\b",
+      "pattern": "chmod\\s+(?:(?:-[a-zA-Z]*|--)\\s+)*[2-7][0-7]{3}\\b",
       "risk_level": "critical",
       "risk_type": "privilege_escalation",
-      "reason": "检测到 setuid/setgid 位设置 (chmod 4xxx/2xxx, 提权)"
+      "reason": "检测到 setuid/setgid 位设置 (chmod 4xxx/2xxx/6xxx 及 3/5/7xxx 组合位, 提权; 含 -R 递归与 -- 分隔符形态)"
     },
     {
       "pattern": "chmod\\s+[ugoa]\\+s\\b",
@@ -114,6 +114,12 @@
       "risk_type": "data_exfiltration",
       "reason": "检测到通过 curl POST 外传可能包含敏感信息的请求"
     },
+    {
+      "pattern": "\\b(?:curl|wget)\\b[^;&|\\n]*(?:-T|--upload-file)\\s+[^;&|\\n]*(?:/etc/shadow|/etc/passwd|/etc/master\\.passwd|id_rsa|id_dsa|id_ecdsa|id_ed25519|\\.aws/credentials|credentials|known_hosts|[^\\s/]*\\.db|secret[^\\s]*|\\.ssh)[^;&|\\n]*https?://(?!127\\.\\d+\\.\\d+\\.\\d+|0\\.0\\.0\\.0|localhost|\\[?::1\\]?)",
+      "risk_level": "critical",
+      "risk_type": "data_exfiltration",
+      "reason": "检测到通过 curl/wget -T/--upload-file 上传敏感文件到外部服务器（数据外传）"
+    },
     {
       "pattern": "\\bnmap\\s+",
       "risk_level": "high",
@@ -592,6 +598,22 @@
       "deny_mode": "deny_both",
       "scope": "root"
     },
+    {
+      "path": ".ssh",
+      "risk_level": "high",
+      "desc": "SSH 配置目录（私钥/授权密钥所在）——整目录删除拦截，目录内文件按具体路径规则（读 known_hosts/config、写 authorized_keys/id_rsa 各自拦截），目录创建/权限设置放行",
+      "deny_mode": "deny_write",
+      "dir_del_only": true,
+      "scope": "home"
+    },
+    {
+      "path": ".aws",
+      "risk_level": "critical",
+      "desc": "AWS 配置目录（凭据所在）——整目录删除拦截，目录内文件按具体路径规则（读 .aws/config 非凭据配置放行、写 credentials 拦截），目录创建/权限设置放行",
+      "deny_mode": "deny_write",
+      "dir_del_only": true,
+      "scope": "home"
+    },
     {
       "path": ".ssh/id_rsa",
       "risk_level": "critical",

package/dist/rules/l2_rules.json

@@ -82,11 +82,25 @@
   "combo_chains": {
     "_comment": "L2 组合攻击链检测：单步操作可能无害，但按 kill chain 顺序组合即为后渗透攻击（参考 ChainWatch 六阶段 kill chain / 玄武实验室 Hermes 案例）。阶段 pattern 匹配 action_detail（含 tool call 参数），链定义要求至少 min_stages 个阶段按顺序出现才命中，防单步误报。A 会话内杀伤链 / D 提权-利用组合 / E 持久化-外联组合在 L2 实现（基于 action_history 子序列匹配）；B 跨会话组合链 / C 敏感数据传播链 / F 跨设备组合依赖行为图与数据流，由 formal_engine 实现。",
     "stages": {
+      "PRIVESC": [
+        "\\b(?:pkexec|doas)\\b",
+        "\\bsudo\\s+-u\\s+root\\b",
+        "\\bsudo\\b[^;&|\\n]*(?:/bin/sh|/bin/bash|\\bchmod\\b|\\bsetcap\\b|\\bvisudo\\b|\\bpasswd\\s+root|\\buseradd\\b)",
+        "\\bchmod\\s+u\\+s\\b|\\bsetcap\\b|\\bsetuid\\b",
+        "\\bsu\\s+-?l?\\s+root\\b"
+      ],
+      "SCAN": [
+        "\\bnc\\s+-z\\b",
+        "\\bnmap\\b(?!\\s+--help\\b)",
+        "\\bmasscan\\b",
+        "\\bhping3\\b",
+        "\\bzenmap\\b",
+        "\\bseq\\b.*\\bnc\\b"
+      ],
       "LISTEN": [
-        "\\bflask\\b",
-        "\\bfastapi\\b",
-        "httpserver",
-        "http\\.server",
+        "\\bsocket\\s*\\([^)]*\\)\\s*[^;&|\\n]*(?:bind\\s*\\([^)]*\\)\\s*[^;&|\\n]*listen\\s*\\(|listen\\s*\\([^)]*\\)\\s*[^;&|\\n]*bind\\s*\\()",
+        "\\bflask\\b|\\bfastapi\\b",
+        "httpserver|http\\.server",
         "\\bnc\\s+-l",
         "\\bsocat\\b",
         "nohup\\s+.*\\bpython",
@@ -94,120 +108,134 @@
         "listen\\("
       ],
       "EXEC": [
-        "subprocess",
-        "os\\.system",
-        "shell\\s*=\\s*True",
-        "\\beval\\(",
-        "\\bexec\\(",
-        "/exec",
-        "\\bbash\\s+-c",
-        "run.*command"
+        "\\bpython3?\\s+-c\\s+['\\\"](?!.*(?:requests|urllib(?:\\.request)?|aiohttp|httpx)\\.(?:post|put|request|send)\\s*\\()(?![^'\\\"]*\\b(?:print|pprint|echo)\\s*\\()",
+        "\\b(?:bash|sh)\\s+-[ce]\\b",
+        "(?:^|[;&|\\s])(?!grep\\b|cat\\b|sed\\b|awk\\b|find\\b|less\\b|more\\b|head\\b|tail\\b)\\b(?:os\\.system\\b|subprocess\\b|shell\\s*=\\s*True\\b)",
+        "\\b(?:bash|sh)\\s+-[ce]\\b",
+        "\\beval\\s*[\\(\\s]|\\bexec\\s*\\(|/exec\\b",
+        "\\bperl\\s+-e\\b|\\bnode\\s+-e\\b|\\bphp\\s+-r\\b",
+        "\\./[\\w.-]+\\.(?:sh|py|pl)\\b"
       ],
-      "SCAN": [
-        "\\bnc\\s+-z",
-        "\\bnmap\\b",
-        "port\\s*scan",
-        "\\bseq\\b.*\\bnc\\b",
-        "192\\.168\\..*nc",
-        "scan.*\\bport"
+      "EXFIL": [
+        "\\bcurl\\b[^;&|\\n]*(?:-X\\s+POST\\s+|-d\\s+|-F\\s+|--data|--upload-file|--data-binary)[^;&|\\n]*(?:/etc/shadow|/etc/passwd|id_rsa|credentials|[^\\s]*\\.db|secret[^\\s]*)[^;&|\\n]*https?://(?!127\\.\\d+\\.\\d+\\.\\d+|0\\.0\\.0\\.0|localhost|\\[?::1\\]?)",
+        "\\bcurl\\b[^;&|\\n]*(?:-X\\s+POST\\s+|-d\\s+|-F\\s+|--data|--upload-file|--data-binary)[^;&|\\n]*https?://(?!127\\.\\d+\\.\\d+\\.\\d+|0\\.0\\.0\\.0|localhost|\\[?::1\\]?)",
+        "\\b(?:curl|wget)\\b[^;&|\\n]*\\s(?:-T|--upload-file)\\s+[^;&|\\n]*https?://(?!localhost|127\\.0\\.0\\.1)",
+        "[^;&|\\n]*\\|\\s*nc\\s+[^;&|\\n]*\\d{1,5}\\b",
+        "\\b(?:scp|sftp|rsync)\\s+[^;&|\\n]*(?:/etc/shadow|/etc/passwd|id_rsa|id_dsa|credentials|\\S*secret\\S*|\\.ssh/)[^;&|\\n]*\\S+@\\S+:",
+        "\\bpython3?\\s+-c\\s+['\\\"][^'\\\"]*(?:requests|urllib(?:\\.request)?|aiohttp)\\.(?:post|put|request|send)\\s*\\([^'\\\"]*['\\\"]"
       ],
       "CRED": [
-        "known_hosts",
-        "\\.ssh",
-        "id_rsa",
-        "/etc/shadow",
-        "/etc/passwd",
-        "credential",
-        "aws.*credentials"
-      ],
-      "EXFIL": [
-        "\\bcurl\\s+.*https?://",
-        "\\bwget\\s+.*https?://",
-        "\\bscp\\s+.*@",
-        "\\brsync\\s+.*@",
-        "POST.*https?://"
+        "(?:cat|head|tail|less|more|sed|awk|strings|base64|dd)\\s+[^;&|\\n]*[~]?/\\.ssh(?:/[\\w.-]+)?\\b",
+        "(?:cat|head|tail|less|more|sed|awk|strings|base64|dd)\\s+[^;&|\\n]*(?:id_rsa|id_dsa|id_ecdsa|\\.aws/credentials|credentials\\.json|\\.netrc)",
+        "(?:cat|head|tail|less|more|sed|awk|strings|base64)\\s+[^;&|\\n]*(?:/etc/shadow|/etc/passwd|/etc/master\\.passwd)",
+        "(?:cat|head|tail|less|more|grep)\\s+[^;&|\\n]*known_hosts",
+        "\\bpython3?\\s+-c\\s+['\\\"][\\s\\S]{0,200}?(?:base64\\.b64encode|open\\s*\\(|Path\\(|io\\.open\\s*\\(|read_text\\s*\\(|read\\s*\\()[\\s\\S]{0,200}?(?:/etc/shadow|/etc/passwd|id_rsa|credentials|\\.ssh)",
+        "(?:grep|find|cat)\\s+[^;&|\\n]*\\b(?:password|secret|passwd|shadow|credential|api[_-]?key)\\b[^;&|\\n]*(?:/etc/shadow|/etc/passwd|id_rsa|credentials|\\.ssh)",
+        "(?:cp|mv|dd|curl)\\s+[^;&|\\n]*(?:/etc/shadow|/etc/passwd|id_rsa|credentials|\\.ssh)"
       ],
       "PERSIST": [
-        "\\bcrontab\\b",
-        "\\bsystemd\\b",
-        "systemctl\\s+enable",
-        "\\.bashrc",
-        "\\.profile",
-        "/etc/rc\\.local",
-        "\\bnohup\\b",
-        "\\bdaemon\\b",
-        "startup\\s+item",
-        "\\bat\\s+reboot"
-      ],
-      "PRIVESC": [
-        "\\bsudo\\b",
-        "\\bsu\\b",
-        "chmod\\s+u\\s*\\+\\s*s",
-        "\\bsetuid\\b",
-        "\\bpkexec\\b",
-        "\\bdoas\\b"
+        "(?:echo|printf|cat)\\b[^;\\n]*\\|[^;\\n]*(?:crontab|at\\b)\\s*-",
+        "\\bsystemctl\\s+enable\\s+",
+        "(?:echo|printf)\\b[^;\\n]*(?:/dev/tcp/|nc\\s+-l|ncat|reverse|backdoor|bash\\s+-i)[^;\\n]*(?:>>|>)\\s*(?:~?/\\.bashrc|~?/\\.profile|/etc/rc\\.local|/etc/crontab)",
+        "\\bat\\s+now\\b|\\bchkconfig\\s+\\S+\\s+on\\b",
+        "\\bcrontab\\s+-e\\b"
       ]
     },
     "chains": [
       {
         "id": "listener-exec-scan",
-        "stages": ["LISTEN", "EXEC", "SCAN"],
+        "stages": [
+          "LISTEN",
+          "EXEC",
+          "SCAN"
+        ],
         "min_stages": 3,
         "risk_level": "high",
         "reason": "组合攻击链：建立监听服务 → 获取命令执行能力 → 网络侦察"
       },
       {
         "id": "listener-exec-cred",
-        "stages": ["LISTEN", "EXEC", "CRED"],
+        "stages": [
+          "LISTEN",
+          "EXEC",
+          "CRED"
+        ],
         "min_stages": 3,
         "risk_level": "critical",
         "reason": "组合攻击链：建立监听服务 → 获取命令执行能力 → 访问凭据文件"
       },
       {
         "id": "listener-exec-exfil",
-        "stages": ["LISTEN", "EXEC", "EXFIL"],
+        "stages": [
+          "LISTEN",
+          "EXEC",
+          "EXFIL"
+        ],
         "min_stages": 3,
         "risk_level": "critical",
         "reason": "组合攻击链：建立监听服务 → 获取命令执行能力 → 数据外传"
       },
       {
         "id": "listener-exec-persist",
-        "stages": ["LISTEN", "EXEC", "PERSIST"],
+        "stages": [
+          "LISTEN",
+          "EXEC",
+          "PERSIST"
+        ],
         "min_stages": 3,
         "risk_level": "high",
         "reason": "组合攻击链：建立监听服务 → 获取命令执行能力 → 持久化后门"
       },
       {
         "id": "exec-scan-cred",
-        "stages": ["EXEC", "SCAN", "CRED"],
+        "stages": [
+          "EXEC",
+          "SCAN",
+          "CRED"
+        ],
         "min_stages": 3,
         "risk_level": "high",
         "reason": "组合攻击链：获取命令执行能力 → 网络侦察 → 访问凭据文件"
       },
       {
         "id": "exec-privesc-cred",
-        "stages": ["EXEC", "PRIVESC", "CRED"],
+        "stages": [
+          "EXEC",
+          "PRIVESC",
+          "CRED"
+        ],
         "min_stages": 3,
         "risk_level": "high",
         "reason": "组合攻击链：获取命令执行能力 → 提权 → 访问凭据文件"
       },
       {
         "id": "privesc-cred-exfil",
-        "stages": ["PRIVESC", "CRED", "EXFIL"],
+        "stages": [
+          "PRIVESC",
+          "CRED",
+          "EXFIL"
+        ],
         "min_stages": 3,
         "risk_level": "critical",
         "reason": "组合攻击链：提权 → 访问凭据文件 → 数据外传"
       },
       {
         "id": "persist-exfil",
-        "stages": ["PERSIST", "EXFIL"],
+        "stages": [
+          "PERSIST",
+          "EXFIL"
+        ],
         "min_stages": 2,
         "risk_level": "high",
         "reason": "组合攻击链：持久化后门 → 数据外传（C2 信标）"
       },
       {
         "id": "exec-persist-exfil",
-        "stages": ["EXEC", "PERSIST", "EXFIL"],
+        "stages": [
+          "EXEC",
+          "PERSIST",
+          "EXFIL"
+        ],
         "min_stages": 3,
         "risk_level": "critical",
         "reason": "组合攻击链：获取命令执行能力 → 持久化后门 → 数据外传"

package/dist/rules/mc_rules.json

@@ -0,0 +1,369 @@
+{
+  "_comment": "L2.2 模型检测规则单一事实源（Python + TS 共用）。原子命题正则 + LTL 公式（前缀 AST）。公式在事件迹位置 0 处评估：LTL 公式满足 = 攻击存在。对应站点 detection-l2-2.html 的 10 条 LTL + 5 条 CTL 规则（CTL 活性降级为 G(!φ) 安全不变量，见 docs/DETECTION_METHODS.md 5.4）。",
+  "ap_patterns": {
+    "reads_credential": [
+      "(?:cat|head|tail|less|more|sed|awk|strings|base64|dd)\\s+[^;&|\\n]*[~]?/\\.ssh(?:/[\\w.-]+)?\\b",
+      "(?:cat|head|tail|less|more|sed|awk|strings|base64|dd)\\s+[^;&|\\n]*(?:id_rsa|id_dsa|id_ecdsa|\\.aws/credentials|credentials\\.json|\\.netrc)",
+      "(?:cat|head|tail|less|more|sed|awk|strings|base64)\\s+[^;&|\\n]*(?:/etc/shadow|/etc/passwd)",
+      "(?:cat|head|tail|less|more|grep)\\s+[^;&|\\n]*known_hosts",
+      "(?:grep|find)\\s+[^;&|\\n]*\\b(?:password|secret|passwd|credential|api[_-]?key)\\b[^;&|\\n]*(?:/etc/shadow|/etc/passwd|id_rsa|credentials|~?/\\.aws/credentials)",
+      "\\bcurl\\b[^;&|\\n]*(?:/etc/shadow|/etc/passwd|id_rsa|credentials|\\.ssh)",
+      "\\bpython3?\\s+-c\\s+['\\\"][\\s\\S]{0,200}?(?:base64\\.b64encode|open\\s*\\(|Path\\(|io\\.open\\s*\\(|read_text\\s*\\(|read\\s*\\()[\\s\\S]{0,200}?(?:/etc/shadow|/etc/passwd|id_rsa|credentials|\\.ssh)"
+    ],
+    "network_egress": [
+      "\\bcurl\\b[^;&|\\n]*(?:-X\\s+POST\\s+|-d\\s+|-F\\s+|--data|--upload-file|--data-binary|-T\\s+)[^;&|\\n]*https?://(?!127\\.\\d+\\.\\d+\\.\\d+|0\\.0\\.0\\.0|localhost|\\[?::1\\]?)",
+      "\\b(?:curl|wget|ftp)\\b[^;&|\\n]*\\s(?:-T|--upload-file|--post-file|--post-data|put)\\b[^;&|\\n]*https?://(?!localhost|127\\.0\\.0\\.1)",
+      "[^;&|\\n]*\\|\\s*(?:nc|netcat)\\s+\\S+\\s+\\d{1,5}\\b",
+      "(?:requests|urllib(?:\\.request)?|aiohttp|httpx)\\.(?:post|put|request|send)\\s*\\(",
+      "\\b(?:scp|sftp|rsync)\\s+[^;&|\\n]*(?:/etc/shadow|/etc/passwd|id_rsa|id_dsa|credentials|\\S*secret\\S*|\\.ssh/)[^;&|\\n]*\\S+@\\S+:",
+      "\\b(?:smtplib|ftplib|paramiko)\\s*\\."
+    ],
+    "execute_file": [
+      "\\bpython3?\\s+-c\\s+['\\\"](?![^'\\\"]*\\b(?:print|pprint|echo)\\s*\\()",
+      "\\b(?:bash|sh)\\s+-[ce]\\b",
+      "\\bos\\.system\\s*\\(",
+      "\\bsubprocess\\.(?:run|call|Popen|check_output|check_call)\\s*\\(",
+      "\\bshell\\s*=\\s*True\\b",
+      "\\beval\\s*[\\(\\s]|\\bexec\\s*\\(|\\bexecve\\b",
+      "\\bperl\\s+-e\\b|\\bnode\\s+-e\\b|\\bphp\\s+-r\\b",
+      "\\./[\\w.-]+\\.(?:sh|py|pl)\\b"
+    ],
+    "write_file": [
+      "(?:>|>>|tee\\s+)\\s*(?:/etc/passwd|/etc/shadow|/etc/crontab|/var/spool/cron/|~?/\\.ssh/(?:authorized_keys|config))",
+      "(?:cp|mv)\\s+[^;&|\\n]*\\s(?:/etc/passwd|/etc/shadow|/etc/crontab)"
+    ],
+    "delete_file": [
+      "\\brm\\s+-[rf]+\\s+/|\\brm\\s+-[rf]+\\s+[^;&|\\n]*(?:/etc|/var|/opt|/home)",
+      "\\bshred\\b|\\bwipe\\b"
+    ],
+    "disable_security": [
+      "iptables\\s+-F|setenforce\\s+0|systemctl\\s+stop\\s+(?:firewalld|apparmor|fail2ban)|ufw\\s+disable",
+      "\\b(?:killing|disable)\\s+(?:selinux|firewall|av)"
+    ],
+    "install_persistence": [
+      "(?:echo|printf|cat)\\b[^;&|\\n]*\\|\\s*(?:crontab|at\\b)\\s*-",
+      "\\bsystemctl\\s+enable\\s+",
+      "(?:echo|printf)\\b[^;&|\\n]*[^;&|\\n]*(?:/dev/tcp/|nc\\s+-l|ncat|reverse|backdoor|bash\\s+-i)[^;&|\\n]*(?:>>|>)\\s*(?:~?/\\.bashrc|~?/\\.profile)",
+      "\\bat\\s+now\\b|\\bchkconfig\\s+\\S+\\s+on\\b",
+      "\\bcrontab\\s+-e\\b"
+    ],
+    "privilege_escalation": [
+      "\\bsudo\\s+-u\\s+root\\b",
+      "\\bsudo\\b[^;&|\\n]*(?:/bin/sh|/bin/bash|\\bchmod\\b|\\bsetcap\\b|\\bvisudo\\b|\\bpasswd\\s+root|\\buseradd\\b)",
+      "\\bchmod\\s+u\\+s\\b|setcap\\b|pkexec\\b|doas\\b|setuid\\b",
+      "\\bsu\\s+-\\s*$|\\bsu\\s+root\\b|\\bsu\\s+-l\\s+root\\b"
+    ],
+    "download_file": [
+      "\\b(?:curl|wget)\\b[^;&|\\n]*(?:-o|--output|--location|-O)\\s+(?:(?:/tmp|/var/tmp|/dev/shm|~/)[\\w./-]*\\.(?:sh|py|pl|elf|bin|out)\\b|\\S+\\.(?:sh|py|pl|elf)\\b)",
+      "\\b(?:git\\s+clone|svn\\s+checkout)\\s+\\S+"
+    ],
+    "archive_data": [
+      "\\b(?:tar|zip|7za?|rar)\\s+[^;&|\\n]*(?:-c|-a)\\s+[^;&|\\n]*(?:(?:/etc|/var|/home|/root)|shadow|passwd|\\.ssh|secret)",
+      "\\bbase64\\b[^;&|\\n]*(?:/etc/shadow|/etc/passwd|id_rsa|secret)"
+    ],
+    "prompt_injection": [
+      "ignore\\s+(?:previous|prior|all)\\s+(?:instructions?|commands?)",
+      "<INFORMATION>|TODO:\\s*(?:send|email|transfer|delete|forward|reserve)"
+    ],
+    "sensitive_data": [
+      "(?:api[_-]?token|access[_-]?token|bearer\\s+[a-z0-9._-]+|sk-[a-z0-9_-]{10,})",
+      "-----BEGIN [A-Z ]*PRIVATE KEY-----",
+      "(?:^|[\\s\\W]|/)(?:\\.env|\\.env\\.local)\\b"
+    ],
+    "lateral_movement": [
+      "\\bssh\\s+[^;&|\\n]*\\S+@\\S+[\\s;&|]+(?:exec|cat|curl|wget|nc|scp|ssh|sudo|chmod|base64)",
+      "\\bssh\\s+-i\\s+\\S+\\s+\\S+@",
+      "(?:psexec|wmiexec|smbexec|sshpass)"
+    ],
+    "clear_logs": [
+      "history\\s+-c\\b",
+      "(?:>|>>)\\s*/var/log/|journalctl\\s+.*--vacuum",
+      "\\b(?:truncate|shred)\\s+[\\w/]*(?:log|journal)",
+      "\\brm\\s+-[rf]+\\s+/var/log/"
+    ]
+  },
+  "rules": [
+    {
+      "id": "mc-ltl-001",
+      "type": "ltl",
+      "formula": [
+        "F",
+        [
+          "&",
+          [
+            "ap",
+            "reads_credential"
+          ],
+          [
+            "F",
+            [
+              "ap",
+              "network_egress"
+            ]
+          ]
+        ]
+      ],
+      "risk_level": "critical",
+      "action": "block",
+      "reason": "凭证读取后网络外传（mc-ltl-001）"
+    },
+    {
+      "id": "mc-ltl-002",
+      "type": "ltl",
+      "formula": [
+        "F",
+        [
+          "&",
+          [
+            "ap",
+            "download_file"
+          ],
+          [
+            "F",
+            [
+              "ap",
+              "execute_file"
+            ]
+          ]
+        ]
+      ],
+      "risk_level": "critical",
+      "action": "block",
+      "reason": "下载后执行（mc-ltl-002）"
+    },
+    {
+      "id": "mc-ltl-003",
+      "type": "ltl",
+      "formula": [
+        "F",
+        [
+          "&",
+          [
+            "ap",
+            "disable_security"
+          ],
+          [
+            "F",
+            [
+              "|",
+              [
+                "ap",
+                "execute_file"
+              ],
+              [
+                "|",
+                [
+                  "ap",
+                  "delete_file"
+                ],
+                [
+                  "ap",
+                  "privilege_escalation"
+                ]
+              ]
+            ]
+          ]
+        ]
+      ],
+      "risk_level": "critical",
+      "action": "block",
+      "reason": "禁用安全后破坏性操作（mc-ltl-003）"
+    },
+    {
+      "id": "mc-ltl-004",
+      "type": "ltl",
+      "formula": [
+        "F",
+        [
+          "&",
+          [
+            "ap",
+            "prompt_injection"
+          ],
+          [
+            "F",
+            [
+              "|",
+              [
+                "ap",
+                "network_egress"
+              ],
+              [
+                "|",
+                [
+                  "ap",
+                  "write_file"
+                ],
+                [
+                  "ap",
+                  "execute_file"
+                ]
+              ]
+            ]
+          ]
+        ]
+      ],
+      "risk_level": "critical",
+      "action": "block",
+      "reason": "注入后敏感操作（mc-ltl-004）"
+    },
+    {
+      "id": "mc-ltl-005",
+      "type": "ltl",
+      "formula": [
+        "F",
+        [
+          "&",
+          [
+            "ap",
+            "reads_credential"
+          ],
+          [
+            "F",
+            [
+              "ap",
+              "lateral_movement"
+            ]
+          ]
+        ]
+      ],
+      "risk_level": "critical",
+      "action": "block",
+      "reason": "凭证读取后横向移动（mc-ltl-005）"
+    },
+    {
+      "id": "mc-ltl-006",
+      "type": "ltl",
+      "formula": [
+        "F",
+        [
+          "&",
+          [
+            "ap",
+            "sensitive_data"
+          ],
+          [
+            "F",
+            [
+              "ap",
+              "clear_logs"
+            ]
+          ]
+        ]
+      ],
+      "risk_level": "critical",
+      "action": "block",
+      "reason": "敏感数据访问后清除日志（mc-ltl-006）"
+    },
+    {
+      "id": "mc-ltl-007",
+      "type": "ltl",
+      "formula": [
+        "F",
+        [
+          "&",
+          [
+            "ap",
+            "privilege_escalation"
+          ],
+          [
+            "F",
+            [
+              "ap",
+              "install_persistence"
+            ]
+          ]
+        ]
+      ],
+      "risk_level": "critical",
+      "action": "block",
+      "reason": "提权后安装持久化（mc-ltl-007）"
+    },
+    {
+      "id": "mc-ltl-008",
+      "type": "ltl",
+      "formula": [
+        "F",
+        [
+          "&",
+          [
+            "ap",
+            "download_file"
+          ],
+          [
+            "F",
+            [
+              "ap",
+              "install_persistence"
+            ]
+          ]
+        ]
+      ],
+      "risk_level": "critical",
+      "action": "block",
+      "reason": "下载后安装持久化（mc-ltl-008）"
+    },
+    {
+      "id": "mc-ltl-009",
+      "type": "ltl",
+      "formula": [
+        "F",
+        [
+          "&",
+          [
+            "ap",
+            "sensitive_data"
+          ],
+          [
+            "F",
+            [
+              "&",
+              [
+                "ap",
+                "archive_data"
+              ],
+              [
+                "F",
+                [
+                  "ap",
+                  "network_egress"
+                ]
+              ]
+            ]
+          ]
+        ]
+      ],
+      "risk_level": "critical",
+      "action": "block",
+      "reason": "敏感数据→归档→外传（mc-ltl-009）"
+    },
+    {
+      "id": "mc-ltl-010",
+      "type": "ltl",
+      "formula": [
+        "F",
+        [
+          "ap",
+          "install_persistence"
+        ]
+      ],
+      "risk_level": "medium",
+      "action": "approval",
+      "reason": "持久化机制安装，需审批（mc-ltl-010）"
+    },
+    {
+      "id": "mc-ctl-001",
+      "type": "ltl",
+      "formula": [
+        "F",
+        [
+          "ap",
+          "clear_logs"
+        ]
+      ],
+      "risk_level": "critical",
+      "action": "block",
+      "reason": "安全不变量：任何情况不得清除日志（mc-ctl-001，AG(!clear_logs) 线性迹降级：违反 ⟺ 出现 clear_logs ⟺ F(clear_logs) 成立）"
+    }
+  ]
+}