@kenhkl/agent-moss 0.16.5 → 0.16.6

package/dist/rules/l1_rules.json

@@ -138,6 +138,36 @@
       "risk_type": "lateral_movement",
       "reason": "检测到网络端口扫描工具，可能用于横向移动侦察"
     },
+    {
+      "pattern": "\\b(?:curl|wget)\\s+(?:-\\S+\\s+)*https?://(?:10\\.\\d+\\.\\d+\\.\\d+|192\\.168\\.\\d+\\.\\d+|172\\.(?:1[6-9]|2\\d|3[01])\\.\\d+\\.\\d+)(?:/(?:\\s|$)|\\s|$)",
+      "risk_level": "high",
+      "risk_type": "lateral_movement",
+      "reason": "检测到对内网地址的存活/服务探测（私网裸 IP 根路径 GET，LM-H1 内网测绘；带具体 API 路径或端口的正常调用不受影响）"
+    },
+    {
+      "pattern": "\\bnc(?:at)?\\s+(?:-\\S+\\s+)*-z\\S*\\s+[^;&|\\n]*(?:10\\.\\d+\\.\\d+\\.\\d+|192\\.168\\.\\d+\\.\\d+|172\\.(?:1[6-9]|2\\d|3[01])\\.\\d+\\.\\d+)",
+      "risk_level": "high",
+      "risk_type": "lateral_movement",
+      "reason": "检测到对内网主机的端口连通性扫描（nc -z 私网目标，LM-H2；本机 localhost/127.0.0.1 检查不受影响）"
+    },
+    {
+      "pattern": "\\barping\\s+[^;&|\\n]*(?:10\\.\\d+\\.\\d+\\.\\d+|192\\.168\\.\\d+\\.\\d+|172\\.(?:1[6-9]|2\\d|3[01])\\.\\d+\\.\\d+)",
+      "risk_level": "high",
+      "risk_type": "lateral_movement",
+      "reason": "检测到 ARP 存活探测（arping 内网目标，LM-H3 内网测绘）"
+    },
+    {
+      "pattern": "\\bdig\\s+[^;&|\\n]*\\baxfr\\b",
+      "risk_level": "high",
+      "risk_type": "lateral_movement",
+      "reason": "检测到 DNS 区域传送枚举（dig axfr，LM-H4 域枚举攻击；正常域名解析不受影响）"
+    },
+    {
+      "pattern": "\\bsmbclient\\s+(?:-\\S+\\s+)*-L\\b",
+      "risk_level": "high",
+      "risk_type": "lateral_movement",
+      "reason": "检测到 SMB 服务枚举（smbclient -L 共享列表探测，LM-H4 服务枚举）"
+    },
     {
       "pattern": ">>\\s*(~|/home/[^/]+)/(\\.bashrc|\\.zshrc|\\.profile|\\.bash_profile|\\.zprofile)",
       "risk_level": "high",
@@ -157,10 +187,40 @@
       "reason": "检测到远程下载脚本到本地 (curl -o script.sh)，存在后续执行风险"
     },
     {
-      "pattern": "base64\\s+-d\\s+.*\\|\\s*bash",
+      "pattern": "base64\\s+(?:-[a-zA-Z]*d[a-zA-Z]*|--decode)\\s*[^;&|\\n]*\\|\\s*(?:bash|sh|zsh|dash|ksh|ash)\\b",
       "risk_level": "high",
       "risk_type": "sensitive_action",
-      "reason": "base64 解码执行（编码绕过，下载或读取内容后解码执行）"
+      "reason": "base64 解码执行（编码绕过，下载或读取内容后解码执行；含 -d/--decode 紧贴管道与 sh/zsh/dash 执行器形态）"
+    },
+    {
+      "pattern": "xxd\\s+[^;&|\\n]*-r\\b[^;&|\\n]*\\|\\s*(?:bash|sh|zsh|dash|ksh|ash)\\b",
+      "risk_level": "high",
+      "risk_type": "sensitive_action",
+      "reason": "xxd 反向解码执行（hex 载荷经 xxd -r 还原后直接喂解释器，编码混淆族）"
+    },
+    {
+      "pattern": "printf\\s+['\\\"][^'\\\"]*(?:\\\\x[0-9a-fA-F]{2}){2,}[^'\\\"]*['\\\"]\\s*[^;&|\\n]*\\|\\s*(?:bash|sh|zsh|dash|ksh|ash)\\b",
+      "risk_level": "high",
+      "risk_type": "sensitive_action",
+      "reason": "printf \\x 十六进制载荷构造执行（编码混淆族）"
+    },
+    {
+      "pattern": "\\bpython[0-9.]*\\s+(?:-[a-zA-Z]+\\s+)*-c\\s+['\\\"][^'\\\"]*\\b(?:os\\.listdir|os\\.scandir|os\\.walk)\\s*\\(\\s*['\\\"](?:/root\\b|/etc\\b)",
+      "risk_level": "high",
+      "risk_type": "sensitive_action",
+      "reason": "检测到 python 内联枚举敏感目录（os.listdir/scandir/walk 对 /root、/etc，IA-H3 信息收集；列举项目目录等正常开发不受影响）"
+    },
+    {
+      "pattern": "\\bpython[0-9.]*\\s+(?:-[a-zA-Z]+\\s+)*-c\\s+['\\\"][^'\\\"]*\\bPath\\s*\\(\\s*['\\\"](?:/root\\b|/etc\\b)[^'\\\"]*['\\\"]\\s*\\)\\s*\\.\\s*(?:iterdir|glob|rglob|walk)\\s*\\(",
+      "risk_level": "high",
+      "risk_type": "sensitive_action",
+      "reason": "检测到 python 内联枚举敏感目录（Path('/root').iterdir() 链式形态，IA-H3）"
+    },
+    {
+      "pattern": "\\bpython[0-9.]*\\s+(?:-[a-zA-Z]+\\s+)*-c\\s+['\\\"].*?['\\\"]\\s*\\*\\s*\\d{7,}",
+      "risk_level": "high",
+      "risk_type": "resource_exhaustion",
+      "reason": "检测到 python 内联大字符串分配（≥百万级 'x'*N 乘法，RE-C3 资源消耗；e2e 实测可瞬间吃掉数百 MB 内存）"
     },
     {
       "pattern": "(?:curl|wget)\\s+\\S+.*\\b(?:chmod|chown)\\s+\\+x\\b",
@@ -2268,4 +2328,4 @@
     }
   ],
   "_comment": "\n2026-09-11 新增：iptables 防火墙规则修改（T1562.004）+ SSH 跳过密钥验证（横向移动），原在 user_rules.json 下沉至此——攻击形态清晰、可静态判定，user_rules 回归仅存用户自定义例外的本位。"
-}
+}