内存马与高级持久化取证深度分析

jps -l | grep catalina

java -jar arthas-boot.jar

sc -d org.apache.catalina.core.ApplicationFilterChain

curl -X POST http://target:8080/actuator/env -d '{"spring.datasource.hikari.connection-init-sql":"SELECT 1"}' -H "Content-Type: application/json"

jcmd <pid> VM.flags | grep -i agent

jcmd <pid> Thread.print | grep -A 5 "agentmain"

Get-ChildItem IIS:\AppPools | Select-Object Name, State

Get-WebConfigurationProperty -Filter "system.webServer/modules" -Name "." -PSPath "IIS:\Sites\Default Web Site"

[System.Reflection.Assembly]::Load([System.Convert]::FromBase64String("TVqQAAMAAAAEAAAA"))

[System.AppDomain]::CurrentDomain.GetAssemblies() | ForEach-Object { $_.Location } | Where-Object { $_ -ne "" }

dotnet-dump collect -p <pid> -o dotnet.dump

dotnet-dump dotnet.dump -c "dumpheap -type System.Reflection.Emit.AssemblyBuilder"

go build -buildmode=plugin -o malplugin.so malplugin.go

package main
func init() {
    http.HandleFunc("/backdoor", handler)
}

gore sym malplugin.so | head -20

go tool objdump -s "main\." malplugin.so | head -50

kill -SIGABRT <pid>

GODEBUG=gctrace=1 ./target_app 2>&1 | grep -i "gc"

python3 -c "import sys; print([m for m in sys.modules.keys() if 'mal' in m])"

python3 -c "import dis; dis.dis(compile('import os; os.system(\"id\")', '<string>', 'exec'))"

php -r "echo ini_get('disable_functions');"

cat /etc/php/*/fpm/pool.d/www.conf | grep -i "listen"

node -e "console.log(Object.keys(require.extensions))"

node --inspect=0.0.0.0:9229 app.js &

kubectl get mutatingwebhookconfigurations -A -o json | jq '.items[].webhooks[].clientConfig.service'

kubectl get validatingwebhookconfigurations -A -o json | jq '.items[].webhooks[].clientConfig.service'

aws lambda get-function-configuration --function-name target_func | jq '.Environment.Variables'

aws lambda list-layers --query 'Layers[].LayerName'

bpftool prog list

bpftool map list

aws logs filter-log-events --log-group-name "/aws/lambda/func-name" --start-time $(date -d '1 hour ago' +%s)000

title: Java Agent Memory Shell Injection Detection
id: c7a8f3e2-1b4d-4e5a-9f6c-8d2e3a1b5c7d
status: experimental
description: Detects Java Agent injection via Attach API or command-line parameters
references:
  - https://att&ck.com/techniques/T1055/012
author: Blue Team
date: 2026/07/10
tags:
  - attack.execution
  - attack.t1055.012
  - attack.t1620
logsource:
  category: process_creation
  product: windows
detection:
  selection_agent_load:
    CommandLine|contains|all:
      - '-javaagent:'
  selection_attach_api:
    Image|endswith:
      - '\jps.exe'
      - '\jcmd.exe'
      - '\jstack.exe'
    CommandLine|contains:
      - 'loadAgent'
  selection_vm_flags:
    Image|endswith:
      - '\java.exe'
    CommandLine|contains:
      - 'VM.flags'
  condition: selection_agent_load or selection_attach_api or selection_vm_flags
falsepositives:
  - Legitimate APM tools (New Relic, Dynatrace, AppDynamics)
  - Java debugging sessions
level: high

title: .NET CLR Profiler Memory Shell Detection
id: d8b9e4f3-2c5e-4f6a-0a7d-9e3f4b2c6d8e
status: experimental
description: Detects CLR Profiler environment variable manipulation for memory shell injection
references:
  - https://attack.mitre.org/techniques/T1055/001
author: Blue Team
date: 2026/07/10
tags:
  - attack.defense-evasion
  - attack.t1055.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_profiler:
    EventID: 4688
    NewProcessName|endswith:
      - '\w3wp.exe'
      - '\dotnet.exe'
      - '\iisexpress.exe'
  selection_env:
    EventID: 4688
    CommandLine|contains:
      - 'COR_ENABLE_PROFILING'
      - 'COR_PROFILER'
  filter_legitimate:
    ParentProcessName|endswith:
      - '\devenv.exe'
      - '\msbuild.exe'
  condition: selection_profiler or selection_env and not filter_legitimate
falsepositives:
  - Visual Studio debugging sessions
  - MSBuild profiling
level: high

title: Go Runtime Memory Shell Indicators
id: e9c0f5a4-3d6f-4a7b-1b8e-0f4a5c3d7e9f
status: experimental
description: Detects Go runtime memory shell indicators including unusual Goroutine patterns
references:
  - https://attack.mitre.org/techniques/T1620
author: Blue Team
date: 2026/07/10
tags:
  - attack.defense-evasion
  - attack.t1620
logsource:
  category: process_creation
  product: linux
detection:
  selection_plugin_load:
    CommandLine|contains:
      - 'plugin.Open'
      - 'plugin.Lookup'
  selection_debug_runtime:
    CommandLine|contains:
      - 'GODEBUG='
      - 'GOTRACEBACK='
      - 'GODEBUG=gctrace'
  selection_symbol_table:
    CommandLine|contains:
      - '-ldflags="-s -w"'
      - '-trimpath'
  condition: selection_plugin_load or selection_debug_runtime
falsepositives:
  - Go application development
  - Legitimate plugin usage
level: medium

#!/bin/bash
echo "[*] Java Process Agent Scan"
for pid in $(pgrep -x java); do
    cmdline=$(cat /proc/$pid/cmdline 2>/dev/null | tr '\0' ' ')
    echo "[+] PID: $pid"
    echo "    CMD: $cmdline"
    if echo "$cmdline" | grep -qi "javaagent\|loadAgent\|instrument"; then
        echo "    [!] WARNING: Agent-related parameter detected"
    fi
    maps_count=$(grep -c "\.so\|\.jar" /proc/$pid/maps 2>/dev/null)
    echo "    Maps: $maps_count shared objects"
    if [ "$maps_count" -gt 500 ]; then
        echo "    [!] WARNING: Unusually high shared object count"
    fi
done

#!/bin/bash
echo "[*] IIS Worker Process CLR Profiler Scan"
for pid in $(tasklist /FI "IMAGENAME eq w3wp.exe" /FO CSV /NH 2>/dev/null | cut -d',' -f2 | tr -d '"'); do
    echo "[+] w3wp.exe PID: $pid"
    env_vars=$(powershell -Command "Get-Process -Id $pid | Select-Object -ExpandProperty StartInfo" 2>/dev/null)
    if echo "$env_vars" | grep -qi "COR_ENABLE_PROFILING\|COR_PROFILER"; then
        echo "    [!] WARNING: CLR Profiler environment detected"
    fi
done

#!/bin/bash
echo "[*] Python Runtime Memory Shell Scan"
for pid in $(pgrep -x python3); do
    echo "[+] PID: $pid"
    modules=$(ls -la /proc/$pid/fd 2>/dev/null | grep -i "socket\|pipe" | wc -l)
    echo "    Open FDs: $modules"
    maps=$(cat /proc/$pid/maps 2>/dev/null | grep -i "rwx" | wc -l)
    echo "    RWX mappings: $maps"
    if [ "$maps" -gt 10 ]; then
        echo "    [!] WARNING: Unusually high RWX memory mappings"
    fi
    env_check=$(cat /proc/$pid/environ 2>/dev/null | tr '\0' '\n' | grep -i "PYTHONSTARTUP\|PYTHONPATH\|LD_PRELOAD")
    if [ -n "$env_check" ]; then
        echo "    [!] WARNING: Suspicious environment: $env_check"
    fi
done

import os
import sys
import subprocess
import json
from datetime import datetime

def scan_java_processes():
    results = []
    try:
        pids = subprocess.check_output(["pgrep", "-x", "java"], text=True).strip().split("\n")
    except subprocess.CalledProcessError:
        return results
    for pid in pids:
        if not pid:
            continue
        info = {"pid": pid, "type": "java", "suspicious": []}
        try:
            cmdline = open(f"/proc/{pid}/cmdline", "r").read().replace("\x00", " ")
            info["cmdline"] = cmdline
            if "-javaagent" in cmdline.lower():
                info["suspicious"].append("javaagent_parameter")
            maps = open(f"/proc/{pid}/maps", "r").readlines()
            anon_exec = sum(1 for line in maps if "[anon:" in line and "rwx" in line)
            info["anon_exec_regions"] = anon_exec
            if anon_exec > 20:
                info["suspicious"].append("high_anon_exec_regions")
        except Exception as e:
            info["error"] = str(e)
        results.append(info)
    return results

def scan_node_processes():
    results = []
    try:
        pids = subprocess.check_output(["pgrep", "-x", "node"], text=True).strip().split("\n")
    except subprocess.CalledProcessError:
        return results
    for pid in pids:
        if not pid:
            continue
        info = {"pid": pid, "type": "node", "suspicious": []}
        try:
            cmdline = open(f"/proc/{pid}/cmdline", "r").read().replace("\x00", " ")
            info["cmdline"] = cmdline
            if "--inspect" in cmdline or "--inspect-brk" in cmdline:
                info["suspicious"].append("debugger_exposed")
            if "0.0.0.0" in cmdline:
                info["suspicious"].append("debugger_all_interfaces")
        except Exception as e:
            info["error"] = str(e)
        results.append(info)
    return results

def main():
    report = {
        "timestamp": datetime.utcnow().isoformat(),
        "hostname": os.uname().nodename,
        "java_processes": scan_java_processes(),
        "node_processes": scan_node_processes()
    }
    all_suspicious = []
    for proc in report["java_processes"] + report["node_processes"]:
        if proc.get("suspicious"):
            all_suspicious.append(proc)
    report["total_suspicious"] = len(all_suspicious)
    print(json.dumps(report, indent=2))
    return 1 if all_suspicious else 0

if __name__ == "__main__":
    sys.exit(main())

rule Java_Memory_Shell_Agent {
    meta:
        description = "Detects Java Agent memory shell artifacts"
        author = "Blue Team"
        date = "2026-07-10"
        reference = "https://attack.mitre.org/techniques/T1055/012"
        severity = "high"
    strings:
        $spy_class = "Spy.class" ascii
        $instrumentation_api = "java.lang.instrument.Instrumentation" ascii
        $premain = "premain" ascii
        $agentmain = "agentmain" ascii
        $retransform_classes = "retransformClasses" ascii
        $add_transformer = "addTransformer" ascii
        $attach_api = "com.sun.tools.attach" ascii
    condition:
        uint16(0) == 0x4B50 and
        (3 of ($spy_class, $instrumentation_api, $premain, $agentmain, $retransform_classes, $add_transformer, $attach_api))
}

rule CLR_Profiler_Memory_Shell {
    meta:
        description = "Detects .NET CLR Profiler memory shell artifacts"
        author = "Blue Team"
        date = "2026-07-10"
        reference = "https://attack.mitre.org/techniques/T1055/001"
        severity = "high"
    strings:
        $cor_profiler = "COR_PROFILER" ascii wide
        $cor_enable = "COR_ENABLE_PROFILING" ascii wide
        $icor_profiler = "ICorProfilerCallback" ascii wide
        $assembly_load = "System.Reflection.Assembly.Load" ascii wide
        $assembly_bytes = "Assembly.Load(byte[])" ascii wide
        $clr_dll = "mscoree.dll" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        (2 of ($cor_profiler, $cor_enable, $icor_profiler, $assembly_load, $assembly_bytes))
}