@kenhkl/agent-moss 0.13.0 → 0.14.0

package/dist/rules/l1_rules.json

@@ -13,8 +13,8 @@
       "reason": "检测到删除关键系统目录"
     },
     {
-      "pattern": "\\brm\\s+-[a-zA-Z]*r[a-zA-Z]*\\s+/(?!tmp/|var/tmp/|run/|dev/shm/)",
-      "risk_level": "high",
+      "pattern": "\\brm\\s+-[a-zA-Z]*r[a-zA-Z]*\\s+/(?!tmp|var/tmp|run|dev/shm|mnt|media)(?:/|\\b)",
+      "risk_level": "medium",
       "risk_type": "script_execution",
       "reason": "检测到递归删除操作 (rm -r /...)"
     },
@@ -25,16 +25,16 @@
       "reason": "检测到强制删除文件 (rm -f /...)"
     },
     {
-      "pattern": "chmod\\s+[0-7]{0,3}7\\b",
+      "pattern": "chmod\\s+(?:(?:-[a-zA-Z]*|--)\\s+)*[0-7]{0,3}7\\b",
       "risk_level": "critical",
       "risk_type": "privilege_escalation",
-      "reason": "检测到危险权限设置 (chmod ...7, other 位含写+执行敞口)"
+      "reason": "检测到危险权限设置 (chmod ...7, other 位含写+执行敞口; 含 -R 递归与 -- 分隔符形态)"
     },
     {
-      "pattern": "chmod\\s+[24][0-7]{3}\\b",
+      "pattern": "chmod\\s+(?:(?:-[a-zA-Z]*|--)\\s+)*[2-7][0-7]{3}\\b",
       "risk_level": "critical",
       "risk_type": "privilege_escalation",
-      "reason": "检测到 setuid/setgid 位设置 (chmod 4xxx/2xxx, 提权)"
+      "reason": "检测到 setuid/setgid 位设置 (chmod 4xxx/2xxx/6xxx 及 3/5/7xxx 组合位, 提权; 含 -R 递归与 -- 分隔符形态)"
     },
     {
       "pattern": "chmod\\s+[ugoa]\\+s\\b",
@@ -114,6 +114,12 @@
       "risk_type": "data_exfiltration",
       "reason": "检测到通过 curl POST 外传可能包含敏感信息的请求"
     },
+    {
+      "pattern": "\\b(?:curl|wget)\\b[^;&|\\n]*(?:-T|--upload-file)\\s+[^;&|\\n]*(?:/etc/shadow|/etc/passwd|/etc/master\\.passwd|id_rsa|id_dsa|id_ecdsa|id_ed25519|\\.aws/credentials|credentials|known_hosts|[^\\s/]*\\.db|secret[^\\s]*|\\.ssh)[^;&|\\n]*https?://(?!127\\.\\d+\\.\\d+\\.\\d+|0\\.0\\.0\\.0|localhost|\\[?::1\\]?)",
+      "risk_level": "critical",
+      "risk_type": "data_exfiltration",
+      "reason": "检测到通过 curl/wget -T/--upload-file 上传敏感文件到外部服务器（数据外传）"
+    },
     {
       "pattern": "\\bnmap\\s+",
       "risk_level": "high",
@@ -592,6 +598,22 @@
       "deny_mode": "deny_both",
       "scope": "root"
     },
+    {
+      "path": ".ssh",
+      "risk_level": "high",
+      "desc": "SSH 配置目录（私钥/授权密钥所在）——整目录删除拦截，目录内文件按具体路径规则（读 known_hosts/config、写 authorized_keys/id_rsa 各自拦截），目录创建/权限设置放行",
+      "deny_mode": "deny_write",
+      "dir_del_only": true,
+      "scope": "home"
+    },
+    {
+      "path": ".aws",
+      "risk_level": "critical",
+      "desc": "AWS 配置目录（凭据所在）——整目录删除拦截，目录内文件按具体路径规则（读 .aws/config 非凭据配置放行、写 credentials 拦截），目录创建/权限设置放行",
+      "deny_mode": "deny_write",
+      "dir_del_only": true,
+      "scope": "home"
+    },
     {
       "path": ".ssh/id_rsa",
       "risk_level": "critical",

package/dist/rules/l2_rules.json

@@ -82,11 +82,25 @@
   "combo_chains": {
     "_comment": "L2 组合攻击链检测：单步操作可能无害，但按 kill chain 顺序组合即为后渗透攻击（参考 ChainWatch 六阶段 kill chain / 玄武实验室 Hermes 案例）。阶段 pattern 匹配 action_detail（含 tool call 参数），链定义要求至少 min_stages 个阶段按顺序出现才命中，防单步误报。A 会话内杀伤链 / D 提权-利用组合 / E 持久化-外联组合在 L2 实现（基于 action_history 子序列匹配）；B 跨会话组合链 / C 敏感数据传播链 / F 跨设备组合依赖行为图与数据流，由 formal_engine 实现。",
     "stages": {
+      "PRIVESC": [
+        "\\b(?:pkexec|doas)\\b",
+        "\\bsudo\\s+-u\\s+root\\b",
+        "\\bsudo\\b[^;&|\\n]*(?:/bin/sh|/bin/bash|\\bchmod\\b|\\bsetcap\\b|\\bvisudo\\b|\\bpasswd\\s+root|\\buseradd\\b)",
+        "\\bchmod\\s+u\\+s\\b|\\bsetcap\\b|\\bsetuid\\b",
+        "\\bsu\\s+-?l?\\s+root\\b"
+      ],
+      "SCAN": [
+        "\\bnc\\s+-z\\b",
+        "\\bnmap\\b(?!\\s+--help\\b)",
+        "\\bmasscan\\b",
+        "\\bhping3\\b",
+        "\\bzenmap\\b",
+        "\\bseq\\b.*\\bnc\\b"
+      ],
       "LISTEN": [
-        "\\bflask\\b",
-        "\\bfastapi\\b",
-        "httpserver",
-        "http\\.server",
+        "\\bsocket\\s*\\([^)]*\\)\\s*[^;&|\\n]*(?:bind\\s*\\([^)]*\\)\\s*[^;&|\\n]*listen\\s*\\(|listen\\s*\\([^)]*\\)\\s*[^;&|\\n]*bind\\s*\\()",
+        "\\bflask\\b|\\bfastapi\\b",
+        "httpserver|http\\.server",
         "\\bnc\\s+-l",
         "\\bsocat\\b",
         "nohup\\s+.*\\bpython",
@@ -94,120 +108,134 @@
         "listen\\("
       ],
       "EXEC": [
-        "subprocess",
-        "os\\.system",
-        "shell\\s*=\\s*True",
-        "\\beval\\(",
-        "\\bexec\\(",
-        "/exec",
-        "\\bbash\\s+-c",
-        "run.*command"
+        "\\bpython3?\\s+-c\\s+['\\\"](?!.*(?:requests|urllib(?:\\.request)?|aiohttp|httpx)\\.(?:post|put|request|send)\\s*\\()(?![^'\\\"]*\\b(?:print|pprint|echo)\\s*\\()",
+        "\\b(?:bash|sh)\\s+-[ce]\\b",
+        "(?:^|[;&|\\s])(?!grep\\b|cat\\b|sed\\b|awk\\b|find\\b|less\\b|more\\b|head\\b|tail\\b)\\b(?:os\\.system\\b|subprocess\\b|shell\\s*=\\s*True\\b)",
+        "\\b(?:bash|sh)\\s+-[ce]\\b",
+        "\\beval\\s*[\\(\\s]|\\bexec\\s*\\(|/exec\\b",
+        "\\bperl\\s+-e\\b|\\bnode\\s+-e\\b|\\bphp\\s+-r\\b",
+        "\\./[\\w.-]+\\.(?:sh|py|pl)\\b"
       ],
-      "SCAN": [
-        "\\bnc\\s+-z",
-        "\\bnmap\\b",
-        "port\\s*scan",
-        "\\bseq\\b.*\\bnc\\b",
-        "192\\.168\\..*nc",
-        "scan.*\\bport"
+      "EXFIL": [
+        "\\bcurl\\b[^;&|\\n]*(?:-X\\s+POST\\s+|-d\\s+|-F\\s+|--data|--upload-file|--data-binary)[^;&|\\n]*(?:/etc/shadow|/etc/passwd|id_rsa|credentials|[^\\s]*\\.db|secret[^\\s]*)[^;&|\\n]*https?://(?!127\\.\\d+\\.\\d+\\.\\d+|0\\.0\\.0\\.0|localhost|\\[?::1\\]?)",
+        "\\bcurl\\b[^;&|\\n]*(?:-X\\s+POST\\s+|-d\\s+|-F\\s+|--data|--upload-file|--data-binary)[^;&|\\n]*https?://(?!127\\.\\d+\\.\\d+\\.\\d+|0\\.0\\.0\\.0|localhost|\\[?::1\\]?)",
+        "\\b(?:curl|wget)\\b[^;&|\\n]*\\s(?:-T|--upload-file)\\s+[^;&|\\n]*https?://(?!localhost|127\\.0\\.0\\.1)",
+        "[^;&|\\n]*\\|\\s*nc\\s+[^;&|\\n]*\\d{1,5}\\b",
+        "\\b(?:scp|sftp|rsync)\\s+[^;&|\\n]*(?:/etc/shadow|/etc/passwd|id_rsa|id_dsa|credentials|\\S*secret\\S*|\\.ssh/)[^;&|\\n]*\\S+@\\S+:",
+        "\\bpython3?\\s+-c\\s+['\\\"][^'\\\"]*(?:requests|urllib(?:\\.request)?|aiohttp)\\.(?:post|put|request|send)\\s*\\([^'\\\"]*['\\\"]"
       ],
       "CRED": [
-        "known_hosts",
-        "\\.ssh",
-        "id_rsa",
-        "/etc/shadow",
-        "/etc/passwd",
-        "credential",
-        "aws.*credentials"
-      ],
-      "EXFIL": [
-        "\\bcurl\\s+.*https?://",
-        "\\bwget\\s+.*https?://",
-        "\\bscp\\s+.*@",
-        "\\brsync\\s+.*@",
-        "POST.*https?://"
+        "(?:cat|head|tail|less|more|sed|awk|strings|base64|dd)\\s+[^;&|\\n]*[~]?/\\.ssh(?:/[\\w.-]+)?\\b",
+        "(?:cat|head|tail|less|more|sed|awk|strings|base64|dd)\\s+[^;&|\\n]*(?:id_rsa|id_dsa|id_ecdsa|\\.aws/credentials|credentials\\.json|\\.netrc)",
+        "(?:cat|head|tail|less|more|sed|awk|strings|base64)\\s+[^;&|\\n]*(?:/etc/shadow|/etc/passwd|/etc/master\\.passwd)",
+        "(?:cat|head|tail|less|more|grep)\\s+[^;&|\\n]*known_hosts",
+        "\\bpython3?\\s+-c\\s+['\\\"][\\s\\S]{0,200}?(?:base64\\.b64encode|open\\s*\\(|Path\\(|io\\.open\\s*\\(|read_text\\s*\\(|read\\s*\\()[\\s\\S]{0,200}?(?:/etc/shadow|/etc/passwd|id_rsa|credentials|\\.ssh)",
+        "(?:grep|find|cat)\\s+[^;&|\\n]*\\b(?:password|secret|passwd|shadow|credential|api[_-]?key)\\b[^;&|\\n]*(?:/etc/shadow|/etc/passwd|id_rsa|credentials|\\.ssh)",
+        "(?:cp|mv|dd|curl)\\s+[^;&|\\n]*(?:/etc/shadow|/etc/passwd|id_rsa|credentials|\\.ssh)"
       ],
       "PERSIST": [
-        "\\bcrontab\\b",
-        "\\bsystemd\\b",
-        "systemctl\\s+enable",
-        "\\.bashrc",
-        "\\.profile",
-        "/etc/rc\\.local",
-        "\\bnohup\\b",
-        "\\bdaemon\\b",
-        "startup\\s+item",
-        "\\bat\\s+reboot"
-      ],
-      "PRIVESC": [
-        "\\bsudo\\b",
-        "\\bsu\\b",
-        "chmod\\s+u\\s*\\+\\s*s",
-        "\\bsetuid\\b",
-        "\\bpkexec\\b",
-        "\\bdoas\\b"
+        "(?:echo|printf|cat)\\b[^;\\n]*\\|[^;\\n]*(?:crontab|at\\b)\\s*-",
+        "\\bsystemctl\\s+enable\\s+",
+        "(?:echo|printf)\\b[^;\\n]*(?:/dev/tcp/|nc\\s+-l|ncat|reverse|backdoor|bash\\s+-i)[^;\\n]*(?:>>|>)\\s*(?:~?/\\.bashrc|~?/\\.profile|/etc/rc\\.local|/etc/crontab)",
+        "\\bat\\s+now\\b|\\bchkconfig\\s+\\S+\\s+on\\b",
+        "\\bcrontab\\s+-e\\b"
       ]
     },
     "chains": [
       {
         "id": "listener-exec-scan",
-        "stages": ["LISTEN", "EXEC", "SCAN"],
+        "stages": [
+          "LISTEN",
+          "EXEC",
+          "SCAN"
+        ],
         "min_stages": 3,
         "risk_level": "high",
         "reason": "组合攻击链：建立监听服务 → 获取命令执行能力 → 网络侦察"
       },
       {
         "id": "listener-exec-cred",
-        "stages": ["LISTEN", "EXEC", "CRED"],
+        "stages": [
+          "LISTEN",
+          "EXEC",
+          "CRED"
+        ],
         "min_stages": 3,
         "risk_level": "critical",
         "reason": "组合攻击链：建立监听服务 → 获取命令执行能力 → 访问凭据文件"
       },
       {
         "id": "listener-exec-exfil",
-        "stages": ["LISTEN", "EXEC", "EXFIL"],
+        "stages": [
+          "LISTEN",
+          "EXEC",
+          "EXFIL"
+        ],
         "min_stages": 3,
         "risk_level": "critical",
         "reason": "组合攻击链：建立监听服务 → 获取命令执行能力 → 数据外传"
       },
       {
         "id": "listener-exec-persist",
-        "stages": ["LISTEN", "EXEC", "PERSIST"],
+        "stages": [
+          "LISTEN",
+          "EXEC",
+          "PERSIST"
+        ],
         "min_stages": 3,
         "risk_level": "high",
         "reason": "组合攻击链：建立监听服务 → 获取命令执行能力 → 持久化后门"
       },
       {
         "id": "exec-scan-cred",
-        "stages": ["EXEC", "SCAN", "CRED"],
+        "stages": [
+          "EXEC",
+          "SCAN",
+          "CRED"
+        ],
         "min_stages": 3,
         "risk_level": "high",
         "reason": "组合攻击链：获取命令执行能力 → 网络侦察 → 访问凭据文件"
       },
       {
         "id": "exec-privesc-cred",
-        "stages": ["EXEC", "PRIVESC", "CRED"],
+        "stages": [
+          "EXEC",
+          "PRIVESC",
+          "CRED"
+        ],
         "min_stages": 3,
         "risk_level": "high",
         "reason": "组合攻击链：获取命令执行能力 → 提权 → 访问凭据文件"
       },
       {
         "id": "privesc-cred-exfil",
-        "stages": ["PRIVESC", "CRED", "EXFIL"],
+        "stages": [
+          "PRIVESC",
+          "CRED",
+          "EXFIL"
+        ],
         "min_stages": 3,
         "risk_level": "critical",
         "reason": "组合攻击链：提权 → 访问凭据文件 → 数据外传"
       },
       {
         "id": "persist-exfil",
-        "stages": ["PERSIST", "EXFIL"],
+        "stages": [
+          "PERSIST",
+          "EXFIL"
+        ],
         "min_stages": 2,
         "risk_level": "high",
         "reason": "组合攻击链：持久化后门 → 数据外传（C2 信标）"
       },
       {
         "id": "exec-persist-exfil",
-        "stages": ["EXEC", "PERSIST", "EXFIL"],
+        "stages": [
+          "EXEC",
+          "PERSIST",
+          "EXFIL"
+        ],
         "min_stages": 3,
         "risk_level": "critical",
         "reason": "组合攻击链：获取命令执行能力 → 持久化后门 → 数据外传"