# 提取文件基本信息
file malware.exe
md5sum malware.exe
sha256sum malware.exe

# 提取 PE 文件信息
pefile malware.exe

# 提取可打印字符串
strings malware.exe | grep -i "http\|ftp\|smtp\|password\|key"

# 提取 Unicode 字符串
strings -el malware.exe

# 使用 IDA Pro 或 Ghidra 进行反汇编
ida malware.exe
ghidra malware.exe

# 使用 objdump 进行简单反汇编
objdump -d malware.exe

# 使用 Process Monitor 监控进程活动
procmon.exe /BackingFile monitor.pml

# 使用 Sysmon 监控系统活动
sysmon.exe -i config.xml

# 使用 Process Monitor 监控文件和注册表活动
# 过滤条件：
# - Operation: CreateFile, WriteFile, RegSetValue
# - Path: C:\*, HKLM\*, HKCU\*

# 使用 Wireshark 捕获网络流量
wireshark -i eth0 -w capture.pcap

# 使用 tcpdump 捕获网络流量
tcpdump -i eth0 -w capture.pcap

Cuckoo Host (分析器)
  ↓
Cuckoo Guest (虚拟机)
  ↓
Malware Sample (恶意软件样本)

# 安装 Cuckoo
pip install cuckoo

# 初始化 Cuckoo
cuckoo init

# 启动 Cuckoo
cuckoo

# 提交样本进行分析
cuckoo submit /path/to/malware.exe

# 通过 Web 界面提交样本
# https://any.run/

# 使用 API 提交样本
curl -X POST "https://api.any.run/v1/analysis" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -F "file=@malware.exe"

# 通过 Web 界面提交样本
# https://www.joesandbox.com/

# 使用 API 提交样本
curl -X POST "https://api.joesandbox.com/v2/analysis/submit" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -F "sample=@malware.exe"

// 检查虚拟机特征
bool IsVMware() {
    unsigned int id;
    __asm {
        push eax
        push ebx
        push ecx
        push edx
        mov eax, 'VMXh'
        mov ecx, 0Ah
        mov dx, 'VX'
        in eax, dx
        cmp ebx, 'VMXh'
        setz [id]
        pop edx
        pop ecx
        pop ebx
        pop eax
    }
    return id == 1;
}

// 检查用户活动
bool IsUserActive() {
    LASTINPUTINFO lii;
    lii.cbSize = sizeof(LASTINPUTINFO);
    GetLastInputInfo(&lii);
    DWORD idleTime = GetTickCount() - lii.dwTime;
    return idleTime < 60000; // 1 分钟内有用户活动
}

// 检查执行时间
bool IsFastExecution() {
    DWORD start = GetTickCount();
    // 执行某些操作
    Sleep(1000);
    DWORD end = GetTickCount();
    return (end - start) < 500; // 执行时间过短
}

# 从 PCAP 文件中提取网络 IOC
tshark -r capture.pcap -Y "dns" -T fields -e dns.qry.name
tshark -r capture.pcap -Y "http.request" -T fields -e http.host -e http.request.uri
tshark -r capture.pcap -Y "tcp" -T fields -e ip.src -e ip.dst -e tcp.dstport

# 提取文件哈希
md5sum dropped_file.exe
sha256sum dropped_file.exe

# 提取文件信息
file dropped_file.exe
strings dropped_file.exe | grep -i "http\|ftp\|smtp"

# 提取注册表键
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"

# 提取服务信息
sc query
Get-Service | Where-Object { $_.Status -eq "Running" }

# 提取计划任务
schtasks /query /fo LIST

{
  "indicators": [
    {
      "type": "ip",
      "value": "192.168.1.100",
      "description": "C2 server"
    },
    {
      "type": "domain",
      "value": "malware.attacker.com",
      "description": "C2 domain"
    },
    {
      "type": "hash",
      "value": "abc123...",
      "algorithm": "sha256",
      "description": "Malware hash"
    }
  ]
}

# 使用 WinPmem 采集 Windows 内存转储
winpmem.exe --output memory_dump.raw

# 使用 FTK Imager 命令行采集
ftkImager.exe --capture-memory --format raw memory_dump.raw

# 使用 LiME 采集 Linux 内存
insmod lime.ko "path=/tmp/memory.lime format=lime"

# 识别操作系统和配置文件
volatility -f memory_dump.raw imageinfo

# 列出所有进程
volatility -f memory_dump.raw --profile=Win10x64 pslist
volatility -f memory_dump.raw --profile=Win10x64 pstree

# 检测隐藏进程
volatility -f memory_dump.raw --profile=Win10x64 psxview

# 分析网络连接
volatility -f memory_dump.raw --profile=Win10x64 netscan

# 检测代码注入
volatility -f memory_dump.raw --profile=Win10x64 malfind

# 提取进程 DLL 列表
volatility -f memory_dump.raw --profile=Win10x64 dlllist -p PID

# 提取内存中的命令行
volatility -f memory_dump.raw --profile=Win10x64 cmdline

# 使用 Rekall 进行进程分析
rekall -f memory_dump.raw pslist
rekall -f memory_dump.raw modules
rekall -f memory_dump.raw malfind

# 搜索内存中的明文凭据
volatility -f memory_dump.raw --profile=Win10x64 hashdump
volatility -f memory_dump.raw --profile=Win10x64 lsadump

# 导出可疑内存区域进行进一步分析
volatility -f memory_dump.raw --profile=Win10x64 memdump -p PID -D output_dir/

# 使用 TShark 提取 DNS 查询
tshark -r capture.pcap -Y "dns.qry.type == 1" -T fields -e dns.qry.name -e dns.a

# 使用 TShark 提取 HTTP 请求
tshark -r capture.pcap -Y "http.request" -T fields -e ip.src -e ip.dst -e http.host -e http.request.uri -e http.request.method

# 使用 TShark 提取 TLS 握手中的 SNI
tshark -r capture.pcap -Y "tls.handshake.type == 1" -T fields -e tls.handshake.extensions_server_name

# 使用 NetworkMiner 提取文件和网络工件
# NetworkMiner 提供 GUI 界面，可自动解析 PCAP 中的文件、图片、证书等

# 检测周期性 HTTP 请求
tshark -r capture.pcap -Y "http.request" -T fields -e frame.time -e ip.dst -e http.host | sort

# 检测 DNS 隧道特征
tshark -r capture.pcap -Y "dns" -T fields -e dns.qry.name -e dns.qry.type | awk '{print length($1), $1}' | sort -rn | head -20

# 统计 DNS 查询频率
tshark -r capture.pcap -Y "dns.qry.type == 1" -T fields -e dns.qry.name | sort | uniq -c | sort -rn | head -20

# 统计 HTTP POST 请求的数据量
tshark -r capture.pcap -Y "http.request.method == POST" -T fields -e ip.dst -e http.host -e http.content_length | sort

# 检测异常大量的出站数据传输
tshark -r capture.pcap -Y "tcp.dstport == 443" -T fields -e ip.dst -e tcp.len | awk '{sum[$1]+=$2} END {for (ip in sum) print sum[ip], ip}' | sort -rn

# 使用 Ghidra 进行无头分析
analyzeHeadless /path/to/project MyProgram -import malware.exe -postScript export_functions.py

# 使用 radare2 进行快速分析
r2 -A malware.exe
aaa
afl
pdf @main

# 使用 x64dbg 进行动态调试
x64dbg malware.exe
# 设置断点关键 API：
# - CreateRemoteThread（进程注入）
# - VirtualAllocEx（远程内存分配）
# - WriteProcessMemory（远程内存写入）
# - InternetConnect（网络连接）
# - RegSetValueEx（注册表操作）

# 使用 WinDbg 进行内核调试
windbg -k com:port=\\.\pipe\debug,pipe

rule Emotet_Loader {
    meta:
        description = "Detects Emotet loader based on strings and byte patterns"
        author = "Forensic Analyst"
        date = "2026-06-24"
        hash = "example_sha256_hash"
        reference = "Emotet Campaign Analysis"

    strings:
        $s1 = "RegOpenKeyExA" ascii
        $s2 = "CryptEncrypt" ascii
        $s3 = "InternetOpenA" ascii
        $s4 = "CreateToolhelp32Snapshot" ascii
        $hex1 = { 8B 45 ?? 83 C0 ?? 8B 4D ?? E8 ?? ?? ?? ?? }
        $hex2 = { 68 ?? ?? ?? ?? 6A 00 6A 00 FF 55 ?? 89 45 ?? }

    condition:
        uint16(0) == 0x5A4D and
        filesize < 5MB and
        3 of ($s*) and
        1 of ($hex*)
}

# 使用 YARA 扫描单个文件
yara emotet_rules.yar malware.exe

# 递归扫描整个目录
yara -r emotet_rules.yar /path/to/suspicious/files/

# 扫描并显示匹配的规则名称
yara -r -s emotet_rules.yar /path/to/files/

# 使用多线程加速扫描
yara -r -p 4 emotet_rules.yar /path/to/files/

# 扫描内存中的进程
yara -r emotet_rules.yar /proc/PID/mem

# VirusTotal API v3 查询文件哈希
curl -s -X GET "https://www.virustotal.com/api/v3/files/{hash}" \
  -H "x-apikey: YOUR_VT_API_KEY" | jq '.data.attributes'

# VirusTotal 查询 URL
curl -s -X GET "https://www.virustotal.com/api/v3/urls/{base64_url}" \
  -H "x-apikey: YOUR_VT_API_KEY" | jq '.data.attributes'

# MalwareBazaar 查询文件哈希
curl -s -X POST "https://mb-api.abuse.ch/api/v1/" \
  -d "query=get_info&hash={sha256_hash}" | jq '.data'

# URLhaus 查询域名
curl -s -X POST "https://urlhaus-api.abuse.ch/api/v1/host/" \
  -d "host=malicious-domain.com" | jq ''

# ThreatFox 查询 IOC
curl -s -X POST "https://threatfox-api.abuse.ch/api/v1/" \
  -d '{"query": "search_ioc", "search_term": "192.168.1.100"}' | jq ''

# MISP 事件查询（使用 PyMISP）
python3 -c "
from pymisp import PyMISP
misp = PyMISP('https://misp.example.com', 'YOUR_API_KEY')
events = misp.search(value='malicious-hash', type_attribute='sha256')
for event in events:
    print(event['Event']['info'])
"

# Malware Analysis Automation Script
Write-Host "=== Malware Analysis Automation ===" -ForegroundColor Cyan

# 1. 提取文件哈希
Write-Host "`n[1] Extracting file hashes..." -ForegroundColor Yellow
$files = Get-ChildItem -Path "C:\Suspicious" -Recurse
foreach ($file in $files) {
    $md5 = Get-FileHash -Path $file.FullName -Algorithm MD5
    $sha256 = Get-FileHash -Path $file.FullName -Algorithm SHA256
    Write-Host "  File: $($file.Name)" -ForegroundColor Yellow
    Write-Host "    MD5: $($md5.Hash)" -ForegroundColor Yellow
    Write-Host "    SHA256: $($sha256.Hash)" -ForegroundColor Yellow
}

# 2. 提取字符串
Write-Host "`n[2] Extracting strings..." -ForegroundColor Yellow
foreach ($file in $files) {
    $strings = strings $file.FullName | Select-String -Pattern "http|ftp|smtp|password|key" -CaseSensitive:$false
    if ($strings) {
        Write-Host "  File: $($file.Name)" -ForegroundColor Yellow
        $strings | ForEach-Object { Write-Host "    $_" -ForegroundColor Yellow }
    }
}

# 3. 提交到 VirusTotal
Write-Host "`n[3] Submitting to VirusTotal..." -ForegroundColor Yellow
foreach ($file in $files) {
    $hash = (Get-FileHash -Path $file.FullName -Algorithm SHA256).Hash
    # 使用 VirusTotal API 查询
    Write-Host "  File: $($file.Name) | Hash: $hash" -ForegroundColor Yellow
}

Write-Host "`n=== Analysis Complete ===" -ForegroundColor Cyan

-- 综合恶意软件分析事件日志狩猎

-- 1. 检测可疑的进程创建
SELECT TimeCreated, ParentProcessName, ProcessName, CommandLine
FROM SecurityEvents
WHERE EventID = 4688
  AND (CommandLine LIKE '%powershell%' OR CommandLine LIKE '%cmd%' OR CommandLine LIKE '%wscript%')
  AND ParentProcessName LIKE '%winword%' OR ParentProcessName LIKE '%excel%'
ORDER BY TimeCreated DESC

-- 2. 检测可疑的网络连接
SELECT TimeCreated, ProcessName, DestinationIP, DestinationPort
FROM SysmonEvents
WHERE EventID = 3
  AND DestinationPort IN (443, 80, 8080, 8443)
  AND DestinationIP NOT LIKE '10.%'
ORDER BY TimeCreated DESC

-- 3. 检测可疑的文件创建
SELECT TimeCreated, ProcessName, TargetFilename
FROM SysmonEvents
WHERE EventID = 11
  AND (TargetFilename LIKE '%.exe' OR TargetFilename LIKE '%.dll' OR TargetFilename LIKE '%.ps1')
  AND TargetFilename LIKE '%Temp%'
ORDER BY TimeCreated DESC

title: Malware Analysis - Suspicious Process Creation
id: c3d4e5f6-a7b8-9012-cdef-345678901234
status: test
description: Detects suspicious process creation from Office applications
references:
    - https://attack.mitre.org/techniques/T1059/
date: 2026-06-23
tags:
    - attack.execution
    - attack.t1059
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        ParentImage|endswith:
            - '\winword.exe'
            - '\excel.exe'
            - '\powerpnt.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    condition: selection
falsepositives:
    - Legitimate macro usage
level: high