1
平台.家族名.变种.描述
2
Win32/Emotet.A        (Microsoft)
3
Trojan.GenericKD.1234 (Bitdefender)
4
Backdoor:Win32/Gh0st!MSR (MS Defender)

1
file sample.exe
2
sha256sum sample.exe
3
ssdeep sample.exe               # 模糊哈希，可做家族聚类
4
exiftool sample.exe             # 编译时间、子系统、调试信息

1
# Linux 分析 Windows 样本
2
pip install pefile
3
python -c "import pefile, sys; [print(i.name.decode()) for i in pefile.PE(sys.argv[1]).DIRECTORY_ENTRY_IMPORT]" sample.exe
4

5
strings -n 6 -e l sample.exe | head -n 50        # UTF-16

1
rule Emotet_Variant_A {
2
  meta:
3
    author = "me"
4
    date = "2026-04"
5
  strings:
6
    $a = "emotetEmotet" wide
7
    $b = { 48 8B 05 ?? ?? ?? ?? 48 85 C0 }
8
  condition:
9
    uint16(0) == 0x5A4D and all of them
10
}

1
Run / RunOnce 键
2
Scheduled Tasks
3
Services（含 Service DLL）
4
WMI Event Subscription (__EventFilter + CommandLineEventConsumer)
5
COM Hijacking
6
BITS Jobs
7
Startup 文件夹 / Shortcut
8
Image File Execution Options (IFEO) Debugger

1
Chain of Custody 证据保管链
2
Integrity           完整性（hash 保存）
3
Preservation        不污染现场
4
Documentation       每一步记录时间 + 操作人 + 工具版本

1
# 镜像制作
2
sudo dc3dd if=/dev/sdb of=disk.img hash=sha256 log=dc3dd.log
3

4
# 挂载只读
5
sudo mount -o ro,loop,noexec disk.img /mnt/case
6

7
# 工具
8
autopsy / sleuthkit：fls, icat, mmls, fsstat
9
ftk-imager：Windows 下 GUI
10
bulk_extractor：批量抽取卡号、邮件、URL

1
# Linux (LiME)
2
sudo insmod lime.ko "path=mem.raw format=raw"
3
# Windows (DumpIt / winpmem)
4
winpmem.exe mem.raw

1
pip install volatility3
2

3
vol -f mem.raw windows.info                          # 识别镜像 profile
4
vol -f mem.raw windows.pslist                        # 进程列表
5
vol -f mem.raw windows.pstree                        # 进程树
6
vol -f mem.raw windows.cmdline                       # 命令行
7
vol -f mem.raw windows.netscan                       # 网络连接
8
vol -f mem.raw windows.malfind                       # 可疑可执行内存页
9
vol -f mem.raw windows.dlllist --pid 1234            # DLL 列表
10
vol -f mem.raw windows.filescan                      # 内存中的文件句柄
11
vol -f mem.raw windows.registry.printkey --key 'Software\Microsoft\Windows\CurrentVersion\Run'

1
vol -f mem.raw linux.pslist
2
vol -f mem.raw linux.bash         # 内存里的 bash 历史
3
vol -f mem.raw linux.check_afinfo # 网络 rootkit 检测

1
<!-- 核心配置：按 Olaf Hartong / SwiftOnSecurity 模板 -->
2
Event ID 1: ProcessCreate        (含 ImageHash, CommandLine, ParentImage)
3
Event ID 3: NetworkConnect
4
Event ID 7: ImageLoaded
5
Event ID 10: ProcessAccess
6
Event ID 11: FileCreate
7
Event ID 13: RegistryValueSet
8
Event ID 22: DNSQuery

1
+-------------------+ 0x00
2
| DOS Header (MZ)   |     IMAGE_DOS_HEADER（e_lfanew → PE Header 偏移）
3
+-------------------+
4
| DOS Stub          |     "This program cannot be run in DOS mode"
5
+-------------------+
6
| PE\0\0 Signature  |     IMAGE_NT_HEADERS 的 Signature
7
+-------------------+
8
| File Header       |     Machine、NumberOfSections、Characteristics
9
+-------------------+
10
| Optional Header   |     Magic(PE32/PE32+)、AddressOfEntryPoint、ImageBase、Subsystem
11
|   + Data Dirs[16] |     Import / Export / Resource / Reloc / TLS ...
12
+-------------------+
13
| Section Table     |     IMAGE_SECTION_HEADER × N
14
+-------------------+
15
| .text, .data, ... |     Sections raw data
16
+-------------------+

1
1. 找 OEP（Original Entry Point）
2
   - 单步追踪到第一个跨段 jmp / call
3
   - ESP / EBP 一致原则（pushad → 找 popad 跳转）
4
   - PE 结构修复：用 Scylla dump 内存 + 重建 IAT
5
2. 修复 IAT
6
   - 跑到 OEP 后，扫描 IAT 区段，恢复每个 thunk 指向真实 API
7
3. dump 镜像
8
   - x64dbg → Scylla 插件
9
4. 验证
10
   - 重新打开看是否能跑；如果 import 错位需要再修

1
// 1. 时间差检测
2
QueryPerformanceCounter(&t1);
3
Sleep(2000);
4
QueryPerformanceCounter(&t2);
5
if ((t2 - t1) < expected) exit_silent();
6

7
// 2. CPU 特性
8
__cpuid(info, 1);
9
if (info[2] & (1 << 31)) /* Hypervisor present bit */ exit();
10

11
// 3. 设备 / 服务
12
"VBoxService" / "VMTools" / "QEMU"
13
"\\.\VBoxMiniRdrDN"
14

15
// 4. 鼠标 / 键盘
16
GetCursorInfo() 静止超时
17

18
// 5. 进程数 / 用户 / 安装软件
19
small process count → sandbox suspect
20

21
// 6. SMBIOS BIOS Vendor / Manufacturer 字段

1
HANDLE h = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
2
LPVOID p = VirtualAllocEx(h, NULL, MAX_PATH, MEM_COMMIT, PAGE_READWRITE);
3
WriteProcessMemory(h, p, dllPath, MAX_PATH, NULL);
4
HANDLE t = CreateRemoteThread(h, NULL, 0,
5
    (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandleA("kernel32"), "LoadLibraryA"),
6
    p, 0, NULL);

1
CreateProcessA("svchost.exe", ..., CREATE_SUSPENDED, ...);
2
NtUnmapViewOfSection(hProc, BaseAddr);
3
VirtualAllocEx + WriteProcessMemory(payload);
4
SetThreadContext(EIP = newEntry);
5
ResumeThread();

1
QueueUserAPC((PAPCFUNC)remoteShellcode, hThread, 0);

1
SuspendThread → GetThreadContext → 改 EIP/RIP 指向 shellcode → SetThreadContext → ResumeThread

1
import "pe"
2
import "math"
3

4
rule complex_match {
5
    strings:
6
        $code = { 48 ?? 8B 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? }       // 字节通配
7
        $jump = { E9 [4-8] 48 8B }                              // 中间 4-8 字节
8
        $hex_jump = { 6A 40 68 ?? ?? ?? ?? FF }
9
        $alt = { (33 C0 | 31 C0) }                              // 选项
10

11
    condition:
12
        // PE + 入口附近代码 + 高熵字符串
13
        pe.is_pe and
14
        any of ($code, $jump) and
15
        math.entropy(0, filesize) > 6.5 and
16
        for any i in (0..pe.number_of_sections - 1) :
17
          (pe.sections[i].name == ".text" and pe.sections[i].raw_data_size > 0)
18
}

1
# 自定义 signature
2
class SuspiciousPersistence(Signature):
3
    name = "suspicious_persistence"
4
    description = "Adds Run key for persistence"
5
    severity = 3
6
    categories = ["persistence"]
7
    authors = ["me"]
8
    minimum = "2.0"
9

10
    filter_apinames = ["RegSetValueExA", "RegSetValueExW"]
11

12
    def on_call(self, call, process):
13
        regkey = self.get_argument(call, "FullName")
14
        if "\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" in regkey:
15
            self.mark_call()
16
            return True

1
log2timeline.py --storage-file case.plaso disk.E01
2
psort.py -o l2tcsv -w timeline.csv case.plaso

1
T+0:00  发现告警（EDR alarm: mass file rename）
2
T+0:05  隔离主机（断网 / 关 vSwitch）
3
T+0:15  初始 triage：影响范围、关键资产
4
T+0:30  启动 IRT、通知 CISO
5
T+1:00  内存 + 磁盘镜像（关键主机）
6
T+2:00  样本提交 + 沙箱分析
7
T+4:00  IOC 提取 + EDR 全网搜
8
T+6:00  C2 域加入 DNS sinkhole
9
T+12:00 备份核验 + 灾备方案
10
T+24:00 决策点：恢复 vs 谈判
11
T+48:00 重构 + 全员凭证轮换
12
T+72:00 报告草稿 + 监管通报
13
T+1 周  全面复盘 + 检测规则升级
14
T+1 月  复测 + 演练

1
T+0  收到员工举报
2
T+15min 邮件回收 + 隔离用户邮箱
3
T+30min Sandbox 分析附件 / URL
4
T+1h    EDR 查所有点击同链接 / 下载附件的人
5
T+2h    重置受影响账号密码 + token
6
T+4h    全员告知 + 培训案例
7
T+24h   报告 + IOC 共享