opencode-skills-collection 4.0.43 → 4.0.44

package/bundled-skills/malware-analysis/references/sandbox-orchestration.md

@@ -0,0 +1,204 @@
+# 沙箱编排与自动化
+
+## 沙箱选型
+
+| 沙箱 | 类型 | 速度 | 逃逸检测 | 推荐场景 |
+|------|:--:|------|:--:|------|
+| CAPE v2 | 开源 | 中 | 强 | 深度分析 + YARA 集成 |
+| ASD Azul | 开源 | 快 | 中 | 大规模批量分类 |
+| Joe Sandbox | 商业 | 中 | 极强 | 高价值样本深度分析 |
+| ANY.RUN | 商业云 | 快 | 中 | 交互式快速分诊 |
+| Triage | 商业云 | 极快 | 弱 | 批量初筛 |
+| Cuckoo v3 | 开源 | 慢 | 弱 | 学习/研究 |
+
+## CAPE Sandbox 部署
+
+```bash
+# Ubuntu 22.04+
+git clone https://github.com/kevoreilly/CAPEv2
+cd CAPEv2
+sudo ./cape2.sh base    # 安装依赖
+sudo ./cape2.sh all     # 完整安装
+
+# Web 界面: http://localhost:8000
+# API: http://localhost:8000/apiv2/
+
+# 提交样本
+curl -F "file=@sample.exe" http://localhost:8000/apiv2/tasks/create/file/
+
+# 批量提交
+for f in samples/*.exe; do
+    curl -F "file=@$f" http://localhost:8000/apiv2/tasks/create/file/
+done
+```
+
+## 自动化分析管道
+
+```python
+# 多沙箱串联管道
+import requests
+import time
+
+def analyze_sample(filepath):
+    """提交样本到多个沙箱并汇总结果"""
+    results = {}
+
+    # 1. 快速分诊（Triage）
+    triage_result = submit_to_triage(filepath)
+    results['triage'] = triage_result
+
+    # 2. 如果 triage 判定可疑 → 深度分析
+    if triage_result['score'] >= 5:
+        cape_result = submit_to_cape(filepath)
+        results['cape'] = cape_result
+
+        # 3. YARA 规则扫描
+        yara_matches = run_yara(filepath, 'rules/')
+        results['yara'] = yara_matches
+
+        # 4. Sigma 规则生成
+        if cape_result.get('behaviors'):
+            sigma_rules = generate_sigma(cape_result['behaviors'])
+            results['sigma'] = sigma_rules
+
+    # 5. IOC 汇总
+    iocs = extract_iocs(results)
+    results['iocs'] = iocs
+
+    return results
+
+def submit_to_cape(filepath):
+    resp = requests.post(
+        'http://cape:8000/apiv2/tasks/create/file/',
+        files={'file': open(filepath, 'rb')},
+        data={'timeout': 300, 'enforce_timeout': True}
+    )
+    task_id = resp.json()['task_id']
+
+    # 轮询等待完成
+    while True:
+        status = requests.get(
+            f'http://cape:8000/apiv2/tasks/view/{task_id}'
+        ).json()['task']['status']
+        if status == 'reported':
+            break
+        time.sleep(5)
+
+    return requests.get(
+        f'http://cape:8000/apiv2/tasks/report/{task_id}/json/'
+    ).json()
+```
+
+## ASD Azul 集成
+
+```bash
+# Azul — 2026 年 ASD 发布的免费大规模分析平台
+git clone https://github.com/AustralianSignalsDirectorate/azul
+cd azul
+
+# 批量导入样本
+azul import samples/ --tags "phishing_campaign_202605"
+
+# 应用 YARA 规则
+azul scan --yara rules/anti_vm_rules.yar
+
+# Snort 规则检测
+azul scan --snort rules/c2_detection.rules
+
+# 自动提取 IOC
+azul export --format stix2 --output iocs.json
+
+# 自定义插件
+azul plugin add custom_unpacker.py  # 添加自定义解包逻辑
+```
+
+## 反沙箱对抗
+
+### 常见沙箱逃逸技术
+
+```text
+1. 定时延迟
+   → Sleep(120000) // 2分钟，超出沙箱超时
+   → 检测: Hook Sleep → 加速时间
+
+2. 用户交互检测
+   → GetTickCount() 检查鼠标移动
+   → 检测: 模拟用户交互
+
+3. 磁盘大小检测
+   → GetDiskFreeSpaceEx < 60GB
+   → 检测: 扩展虚拟磁盘
+
+4. 特定文件/进程检测
+   → C:\agent\agent.pyw (CAPE)
+   → 检测: 重命名检测组件
+
+5. WMI 虚拟机检测
+   → Win32_ComputerSystem.Manufacturer = "VMware, Inc."
+   → 检测: 修改 SMBIOS
+
+6. MAC 地址检测
+   → 00:0C:29 (VMware OUI), 08:00:27 (VirtualBox)
+   → 检测: 随机 MAC
+```
+
+### CAPE 反逃逸配置
+
+```python
+# CAPE 配置
+[processing]
+# 启用反反分析
+antievasion = yes
+
+# 模拟人机交互
+human_interaction = yes
+
+# 最小运行时间
+timeout = 600
+
+# 检测特定技术
+detect_sleep_skip = yes
+detect_debugger_check = yes
+detect_vm_check = yes
+```
+
+## IOC 自动化提取
+
+```python
+def extract_iocs(analysis_results):
+    iocs = {
+        'network': {'ip': [], 'domain': [], 'url': [], 'user_agent': []},
+        'host': {'files': [], 'registry': [], 'mutex': [], 'services': []},
+        'mitre': [],
+        'hashes': {}
+    }
+
+    # CAPE → IOC 提取
+    if 'cape' in analysis_results:
+        cape = analysis_results['cape']
+        behavior = cape.get('behavior', {})
+
+        # 网络 IOC
+        for conn in behavior.get('network', {}).get('tcp', []):
+            iocs['network']['ip'].append(conn['dst'])
+        for dns in behavior.get('network', {}).get('dns', []):
+            iocs['network']['domain'].append(dns['request'])
+
+        # 文件 IOC
+        for dropped in behavior.get('dropped', []):
+            iocs['host']['files'].append(dropped['path'])
+
+        # Mutex
+        for mutex in behavior.get('summary', {}).get('mutex', []):
+            iocs['host']['mutex'].append(mutex)
+
+    # YARA → MITRE 映射
+    if 'yara' in analysis_results:
+        for match in analysis_results['yara']:
+            if 'mitre_id' in match.get('meta', {}):
+                iocs['mitre'].extend(match['meta']['mitre_id'].split(','))
+
+    return iocs
+```
+
+Source: CAPE v2 docs, ASD Azul documentation, Joe Sandbox v44, Anti-VM YARA Library (2026)

package/bundled-skills/malware-analysis/references/yara-sigma-rules.md

@@ -0,0 +1,232 @@
+# YARA + Sigma 规则编写方法论
+
+## YARA 规则编写
+
+### 基本语法
+
+```yara
+rule RuleName {
+    meta:
+        description = "规则描述"
+        author = "作者"
+        date = "2026-01"
+        severity = "low/medium/high/critical"
+        mitre_id = "T1234"
+
+    strings:
+        $ = "ASCII 字符串"
+        $ = { 48 65 6C 6C 6F }         // 十六进制
+        $ = /regex[0-9]{4}/             // 正则
+        $ = "wide_string" wide          // UTF-16
+        $ = "xor_encoded" xor           // XOR 编码
+        $ = "case_insensitive" nocase   // 忽略大小写
+
+    condition:
+        // 逻辑组合
+        uint16(0) == 0x5A4D and         // MZ header
+        filesize < 500KB and
+        (2 of ($s*) or $hex1) and
+        not ($benign1 and $benign2)
+}
+```
+
+### 性能优化
+
+```yara
+// ❌ 慢 — 全文件正则
+condition: /https?:\/\/.*\.php/
+
+// ✅ 快 — 先锚定字符串再限定位置
+strings: $url = "http"
+condition: $url and /https?:\/\/[a-z0-9.-]+\/[a-z]{3,8}\.php/ in (0..filesize)
+
+// ❌ 慢 — 无锚点
+condition: any of them
+
+// ✅ 快 — 锚定在可用字符串上
+condition: uint16(0) == 0x5A4D and any of them
+```
+
+### 反分析技术检测规则
+
+```yara
+// 虚拟机检测
+rule AntiVM_WMI_Detection {
+    meta:
+        description = "检测通过 WMI 查询虚拟机信息"
+        severity = "medium"
+        mitre_id = "T1497"
+    strings:
+        $wmi1 = "SELECT * FROM Win32_BIOS" nocase
+        $wmi2 = "SELECT * FROM Win32_VideoController" nocase
+        $wmi3 = "SELECT * FROM Win32_NetworkAdapter" nocase
+        $wmi4 = "SELECT * FROM Win32_ComputerSystem" nocase
+        $bios = "VMware" nocase
+        $bios2 = "VirtualBox" nocase
+        $bios3 = "QEMU" nocase
+    condition:
+        uint16(0) == 0x5A4D and
+        (2 of ($wmi*)) and
+        (1 of ($bios*))
+}
+
+// 调试器检测
+rule AntiDebug_PEB_Check {
+    meta:
+        description = "通过 PEB.BeingDebugged 检测调试器"
+        severity = "medium"
+        mitre_id = "T1622"
+    strings:
+        // x64: mov rax, gs:[0x60]; movzx eax, byte [rax+2]
+        $peb_x64 = { 65 48 8B 04 25 60 00 00 00 0F B6 40 02 }
+        // x86: mov eax, fs:[0x30]; movzx eax, byte [eax+2]
+        $peb_x86 = { 64 A1 30 00 00 00 0F B6 40 02 }
+    condition:
+        uint16(0) == 0x5A4D and
+        any of them
+}
+```
+
+### 94 种反分析技术分类
+
+| 类别 | 技术数量 | YARA 可检测 | 示例 |
+|------|:--:|:--:|------|
+| 定时检测 | 12 | 低 | Sleep → GetTickCount 对比 |
+| CPU 指纹 | 8 | 中 | CPUID 指令检测 hypervisor |
+| 固件/BIOS 检测 | 6 | **高** | SMBIOS 字符串匹配 |
+| 硬件指纹 | 10 | 中 | MAC 地址/硬盘序列号检测 |
+| API Hook 枚举 | 5 | 中 | NtQueryInformationProcess |
+| 进程检测 | 15 | **高** | 进程名字符串 (frida, wireshark) |
+| 文件系统检测 | 12 | **高** | 路径字符串 (C:\Program Files\VMware) |
+| 注册表检测 | 8 | **高** | 注册表路径字符串 |
+| 窗口检测 | 8 | **高** | 窗口类名/标题 (x64dbg, OLLYDBG) |
+
+> 42/82 条规则 ≥75% 精度 (Anti-VM YARA Library, April 2026)
+
+## Sigma 规则编写
+
+### 规则模板
+
+```yaml
+title: 标题 — 描述检测行为
+id: UUID-v4（生成后不变）
+status: stable/experimental/test/deprecated
+description: 详细描述
+author: 作者
+date: YYYY/MM/DD
+modified: YYYY/MM/DD
+references:
+    - https://attack.mitre.org/techniques/TXXXX/
+    - 内部引用
+
+logsource:
+    category: process_creation     # Windows 事件 ID 4688
+    product: windows
+    # 或: service, product: linux, category: sysmon
+
+detection:
+    # 选择条件
+    selection_base:
+        EventID: 4688
+    selection_malicious:
+        CommandLine|contains:
+            - 'suspicious_command'
+            - 'malware_pattern'
+    # 过滤条件
+    filter_legitimate:
+        ParentImage|endswith: '\explorer.exe'
+    
+    # 最终条件
+    condition: selection_base and selection_malicious and not filter_legitimate
+
+falsepositives:
+    - 合法管理工具
+    - 软件开发工具
+level: low/medium/high/critical
+tags:
+    - attack.tXXXX
+    - attack.tXXXX.XXX
+    - detection.malware
+```
+
+### PowerShell 恶意行为检测
+
+```yaml
+title: Suspicious PowerShell Download and Execute
+id: e3b0c442-98fc-4c78-a0e5-123456789abc
+status: experimental
+description: |
+  检测使用 PowerShell 下载并执行 Payload 的行为，
+  常见于无文件恶意软件和初始访问阶段。
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection:
+        Image|endswith:
+            - '\powershell.exe'
+            - '\pwsh.exe'
+        CommandLine|contains|all:
+            - 'DownloadString'
+            - 'Invoke-Expression'  # security-allowlist: SEC004
+    condition: selection
+falsepositives:
+    - 系统管理员自动化脚本
+    - 软件部署工具
+level: high
+tags:
+    - attack.t1059.001  # PowerShell
+    - attack.t1105      # Ingress Tool Transfer
+```
+
+### 勒索软件行为检测
+
+```yaml
+title: Potential Ransomware Activity — File Encryption + Shadow Copy Deletion
+id: a1b2c3d4-5678-90ab-cdef-0123456789ab
+status: stable
+description: |
+  检测同时出现批量文件写入和卷影副本删除的勒索软件特征行为。
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    sel_vss:
+        CommandLine|contains:
+            - 'vssadmin delete shadows'
+            - 'wmic shadowcopy delete'
+            - 'Get-WmiObject Win32_Shadowcopy | Remove-WmiObject'
+    sel_bcdedit:
+        CommandLine|contains:
+            - 'bcdedit /set {default} recoveryenabled No'
+    condition: sel_vss or sel_bcdedit
+level: critical
+tags:
+    - attack.t1490  # Inhibit System Recovery
+    - attack.t1486  # Data Encrypted for Impact
+```
+
+## 规则测试
+
+```bash
+# YARA 规则验证
+yara -C rule.yara sample_dir/    # 编译规则并扫描
+yara -s rule.yara sample.exe     # 显示匹配字符串
+yara --print-meta rule.yara      # 打印元数据
+
+# Sigma 规则转换
+sigmac -t splunk rule.yml        # → Splunk SPL
+sigmac -t elastalert rule.yml    # → Elastalert
+sigmac -t es-qs rule.yml         # → Elasticsearch Query
+sigma convert -t splunk rule.yml # sigma-cli 新版
+
+# 规则质量检查
+# 1. 不会在正常系统触发
+# 2. 不会在常见软件安装/运行中触发
+# 3. 在已知恶意样本上 100% 触发
+
+# False Positive 验证
+# 在 Assemblage 良性样本集（92,508 样本）上测试
+```
+
+Source: CCCS YARA Standard, SigmaHQ, Anti-VM YARA Library (2026), Joe Sandbox v44

package/bundled-skills/mobile-reverse/SKILL.md

@@ -0,0 +1,222 @@
+---
+name: mobile-reverse
+description: "Authorized Android/iOS application reverse engineering and security testing: APK/IPA analysis, runtime instrumentation (Frida/Objection), SSL-pinning and jailbreak/root-detection bypass, per OWASP MASTG."
+risk: offensive
+source: "https://github.com/zhaoxuya520/reverse-skill"
+source_repo: "zhaoxuya520/reverse-skill"
+source_type: community
+date_added: "2026-08-25"
+license: "MIT"
+license_source: "https://github.com/zhaoxuya520/reverse-skill/blob/main/LICENSE"
+---
+> **⚠️ AUTHORIZED USE ONLY**
+> This skill is for educational purposes or authorized security assessments only.
+> You must have explicit, written permission from the system owner before using this tool.
+> Misuse of this tool is illegal and strictly prohibited.
+
+> **Mandatory confirmation gate**
+> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
+> 1. Ask the user to state the exact target URL, IP, account, or resource.
+> 2. Ask the user to confirm written authorization and the permitted scope.
+> 3. Show the exact command(s) and explain their expected effect.
+> 4. Wait for explicit confirmation in the current conversation.
+>
+> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
+
+# Mobile Reverse Engineering
+## When to Use
+
+- Assessing a mobile app's security posture within an approved scope.
+- Instrumenting runtime behavior or bypassing transport protections in tests.
+
+
+## 适用场景
+
+- Android APK 逆向与安全测试
+- iOS IPA 逆向与安全测试
+- 移动应用运行时动态插桩
+- SSL Pinning / Root 检测 / 越狱检测绕过
+- 移动端加密算法提取（AES/RSA/HMAC 密钥）
+- 移动应用渗透测试（OWASP MASTG）
+- 非 Root/越狱环境下的应用测试
+
+## 四阶段工作流
+
+### Phase 1: 信息收集
+
+```text
+Android：
+□ APK 获取（Google Play / APKMirror / adb pull）
+□ Manifest 分析: 权限、导出组件、Intent Filter、backup 标志
+□ androguard: androguard analyze APK → 组件/权限/签名
+□ APKLeaks: 硬编码 API Key / Token / Secret 扫描
+□ 加固检测: 是否加壳（360/腾讯/梆梆/爱加密）
+
+iOS：
+□ IPA 获取（App Store / ipatool / Apple Configurator）
+□ 解密 App Store 二进制: frida-ios-dump / Clutch
+□ Info.plist 分析: ATS 配置、URL Scheme、Queries Schemes
+□ class-dump: 导出 ObjC 类结构
+□ 加固检测: 是否使用 Swift/ObjC 混淆
+```
+
+### Phase 2: 静态分析
+
+```text
+跨平台：
+□ JADX-GUI: APK → Java 源码（Android）
+□ Ghidra / Hopper: .so / Mach-O 反编译
+□ radare2 / Cutter: CLI 快速侦察
+
+Android 专项：
+□ apktool d app.apk → smali 代码 + 资源
+□ dex2jar: DEX → JAR → JD-GUI
+□ smali/baksmali: Dalvik 字节码修改
+
+iOS 专项：
+□ class-dump: 导出 ObjC 头文件
+□ Swift 符号恢复: swift-demangle
+□ dsymutil: 调试符号提取
+□ otool -L: 查看动态库依赖
+□ jtool2: Mach-O 分析
+```
+
+### Phase 3: 动态分析
+
+```text
+Frida — 通用动态插桩：
+□ frida-ps -U: 列出设备进程
+□ frida-trace -U -i "open*" com.app: 追踪函数调用
+□ 自定义 Hook 脚本: 修改参数/返回值、调用私有方法
+
+Objection — Frida 增强层（无需写脚本）：
+□ objection -g "com.app" explore
+□ android root disable / ios jailbreak disable
+□ android sslpinning disable / ios sslpinning disable
+□ android keystore list / ios keychain dump
+□ env / ls / sqlite connect
+
+Frida Gadget（免 Root/越狱）：
+□ 注入 frida-gadget.so / FridaGadget.dylib 到 APK/IPA
+□ 重新签名 → 安装 → 无需设备权限即可 Hook
+□ objection patchapk --source app.apk（全自动）
+```
+
+### Phase 4: 网络分析
+
+```text
+□ Burp Suite: 拦截 HTTP/HTTPS，修改请求/响应
+□ mitmproxy: 脚本化代理（Python API）
+□ Wireshark: PCAP 抓包分析
+□ 证书安装: Android 用户证书 → 系统证书（Magisk + MoveCert）
+□ SSL Pinning 绕过: Frida/Objection/Xposed/SSL Kill Switch 2
+□ WebSocket / gRPC 流量分析
+```
+
+## 常见绕过速查
+
+### SSL Pinning
+
+```bash
+# Objection（最简）
+objection -g "com.app" explore
+android sslpinning disable
+
+# Frida 通用脚本
+frida -U -l ssl_pinning_bypass.js -f com.app
+
+# Xposed（Android）
+TrustMeAlready 模块 → 全局禁用证书校验
+```
+
+### Root / 越狱检测
+
+```bash
+# Objection
+android root disable
+ios jailbreak disable
+
+# Frida 自定义（多层检测）
+Java.perform(function() {
+    var RootBeer = Java.use("com.scottyab.rootbeer.RootBeer");
+    RootBeer.isRooted.implementation = function() { return false; };
+    // 额外绕过: Magisk su 检测、frida-server 检测、/proc/self/maps 检测
+});
+```
+
+### 反调试
+
+```bash
+# Android
+frida -U -l anti_debug_bypass.js -f com.app
+# 绕过: ptrace(TracerPid)、/proc/self/status、isDebuggerConnected()
+
+# iOS
+# 绕过: PT_DENY_ATTACH、sysctl CTL_KERN/KERN_PROC/KERN_PROC_PID
+frida -U -l ios_anti_debug.js -f com.app
+```
+
+## 移动端加密提取
+
+```javascript
+// Android — Hook Cipher.getInstance 获取密钥+算法
+Java.perform(function() {
+    var Cipher = Java.use("javax.crypto.Cipher");
+    Cipher.getInstance.overload('java.lang.String').implementation = function(algo) {
+        console.log("[Cipher] Algorithm: " + algo);
+        return this.getInstance(algo);
+    };
+    Cipher.init.overload('int', 'java.security.Key').implementation = function(mode, key) {
+        console.log("[Cipher] Key: " + bytesToHex(key.getEncoded()));
+        return this.init(mode, key);
+    };
+});
+
+// iOS — Hook CCCrypt
+Interceptor.attach(Module.findExportByName("libcommonCrypto.dylib", "CCCrypt"), {
+    onEnter: function(args) {
+        console.log("CCCrypt op: " + args[0] + " alg: " + args[1]);
+        console.log("Key: " + hexdump(args[3], { length: args[4].toInt32() }));
+    }
+});
+```
+
+## 工具链
+
+| 工具 | 平台 | 用途 |
+|------|:--:|------|
+| JADX-GUI | A | Java 反编译 |
+| apktool | A | APK 解包/重建 |
+| Ghidra | A+I | 多架构反编译 |
+| Hopper | I | iOS 专用反汇编 |
+| Frida | A+I | 动态插桩 |
+| Objection | A+I | Frida REPL 增强 |
+| MobSF | A+I | 自动化 SAST+DAST |
+| class-dump | I | ObjC 类导出 |
+| frida-ios-dump | I | IPA 解密 |
+| jtool2 | I | Mach-O 分析 |
+| Burp Suite | A+I | HTTP 拦截 |
+| mitmproxy | A+I | 脚本化代理 |
+
+> A=Android, I=iOS
+
+## 参考
+
+- `references/frida-objection-deep.md` — Frida + Objection 深度用法
+- `references/ios-reverse-guide.md` — iOS 逆向专项
+- `references/anti-detection-bypass.md` — Root/越狱/反调试/SSL Pinning 绕过
+
+
+## 任务完成自检（声称完成前 MUST 通过）
+
+- [ ] 我是否执行了工作流中的每一步（而不是只阅读）？
+- [ ] 我是否基于 `tool-index` 使用了真实工具路径？
+- [ ] 我是否产出了可复现证据（命令/脚本/截图/报告）？
+- [ ] 我是否完成并回写了 RULES 要求的 Checklist 项？
+
+## Limitations
+
+- iOS instrumentation requires a jailbroken device or patched build.
+- Bypass techniques break with app-shield vendor updates.
+
+> Adapted from [zhaoxuya520/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) (MIT).