Rust语言安全取证深度分析

strings suspicious_binary | grep -E "^rustc|cargo|/registry/src/"
strings suspicious_binary | grep -E "\.rs$"
strings suspicious_binary | grep -i "panicked at"
strings suspicious_binary | grep "thread.*panicked"
readelf -s suspicious_binary | grep -E "rustc_|std::|core::"
readelf -p .rodata suspicious_binary | grep -E "unwrap\(\)|expect\(\)"
file suspicious_binary

objdump -t suspicious_binary | grep -iE "rust|cargo|tokio|serde"
nm suspicious_binary | c++filt | grep -E "core::|std::|alloc::"
readelf -S suspicious_binary | grep -E "\.eh_frame|\.gcc_except_table"

echo "_RUST_BACKTRACE=1" > /tmp/rust_env

echo "_ZN4test3foo17h1234567890abcdefE" | rustfilt
rustfilt "_R0CNyBoCSyDWSTmEWrE2W_4test3foo"

rustup component add rustc-dev
cargo doc --document-private-items

nm suspicious_binary | c++filt | head -50
objdump -t suspicious_binary | c++filt | grep "test::"

cargo install cargo-symbols
cargo symbols --lib suspicious_binary 2>/dev/null | head -100

readelf -s suspicious_binary | c++filt | grep -E "core::|std::|alloc::" | head -30

strings -n 8 suspicious_binary | grep -v "^[\x00-\x1f]" | head -50

strings -e l suspicious_binary | head -20
strings -e L suspicious_binary | head -20

strings suspicious_binary | grep -E "panicked at|thread .*panicked|assertion failed"
strings suspicious_binary | grep -E "Option|Result|Some|None|Ok|Err"

python3 -c "
import subprocess, re
result = subprocess.run(['strings', '-n', '12', 'suspicious_binary'],
                       capture_output=True, text=True)
rust_patterns = [
    r'panicked at', r'thread .*panicked',
    r'called .Result.unwrap\(\)', r'called .Option.unwrap\(\)',
    r'assertion failed', r'index out of bounds',
    r'borrowed value does not live long enough',
    r'capacity overflow'
]
for line in result.stdout.splitlines():
    for pat in rust_patterns:
        if re.search(pat, line):
            print(f'[RUST_STRING] {line[:200]}')
            break
"

strace -f -e trace=network,process,write suspicious_binary 2>&1 | \
  grep -E "clone|clone3|thread|socket|connect|write.*\["

readelf -d suspicious_binary | grep NEEDED
readelf -d suspicious_binary | grep -E "NEEDED|RUNPATH|RPATH"
nm suspicious_binary | c++filt | grep -E "tokio::runtime|tokio::net" | head -20

strings suspicious_binary | grep -E "^[a-z]+(\.[a-z]+){1,}\.com(:[0-9]+)?$"
strings suspicious_binary | grep -E "onion|\.bit$"
strings suspicious_binary | grep -E "/tmp/|/var/|AppData|\\\\Temp"

strings -n 4 suspicious_binary | while read -r s; do
  entropy=$(echo -n "$s" | LC_ALL=C tr -d '[:print:]' | wc -c)
  if [ "$entropy" -gt 3 ]; then
    echo "[HIGH_ENTROPY_STRING] $s"
  fi
done | head -30

rabin2 -z suspicious_binary | grep -E "encrypted|obfuscat|decrypt|xor" | head -20
objdump -d suspicious_binary | grep -E "xor|rol|ror|bswap" | head -50

ltrace -S -e "ptrace+getenv+access" suspicious_binary 2>&1 | \
  head -100

cat > /tmp/anti_debug_bypass.sh << 'EOF'
#!/bin/bash
BINARY="$1"
LD_PRELOAD=/usr/lib/libdl.so gdb -batch \
  -ex "set disable-randomization off" \
  -ex "break ptrace" \
  -ex "continue" \
  -ex "set \$rax=0" \
  -ex "continue" \
  "$BINARY"
EOF
chmod +x /tmp/anti_debug_bypass.sh

objdump -d suspicious_binary | grep -B2 -A10 "call.*ptrace\|call.*mmap\|call.*mprotect" | head -100

strings suspicious_binary | grep -E "unsafe|raw pointer|deref" | head -20

#!/usr/bin/env python3
import subprocess
import re
import sys

def find_unsafe_patterns(binary_path):
    result = subprocess.run(
        ['objdump', '-d', binary_path],
        capture_output=True, text=True
    )
    dangerous_calls = [
        r'call\s+.*(?:ptrace|mmap|mprotect|VirtualAlloc|WriteProcessMemory)',
        r'call\s+.*(?:dlopen|dlsym|LoadLibrary|GetProcAddress)',
        r'call\s+.*(?:execve|system|popen)',
    ]
    findings = []
    for line in result.stdout.splitlines():
        for pattern in dangerous_calls:
            if re.search(pattern, line, re.IGNORECASE):
                findings.append(line.strip())
    return findings

if __name__ == '__main__':
    binary = sys.argv[1] if len(sys.argv) > 1 else 'suspicious_binary'
    results = find_unsafe_patterns(binary)
    for r in results[:50]:
        print(f'[UNSAFE_CALL] {r}')
    print(f'Total dangerous calls found: {len(results)}')

cargo audit --json 2>/dev/null | python3 -c "
import json, sys
data = json.load(sys.stdin)
vulns = data.get('vulnerabilities', {}).get('list', [])
for v in vulns:
    pkg = v.get('advisory', {}).get('package', 'unknown')
    vid = v.get('advisory', {}).get('id', 'unknown')
    severity = v.get('advisory', {}).get('cvss', 'N/A')
    title = v.get('advisory', {}).get('title', 'N/A')
    print(f'[VULN] {vid} | {pkg} | CVSS: {severity} | {title}')
"

cargo tree --format "{p} -> {f}" 2>/dev/null | head -50

cat Cargo.lock | python3 -c "
import sys, re
content = sys.stdin.read()
packages = re.findall(r'\[\[package\]\]\nname = \"(.+?)\"\nversion = \"(.+?)\"', content)
for name, ver in packages:
    print(f'{name} = {ver}')
" | sort | head -50

cargo deny check 2>&1 | grep -E "warning|error|RUSTSEC" | head -30

cargo audit --deny warnings 2>&1 | grep -E "RUSTSEC|advisories" | head -20

#!/usr/bin/env python3
import subprocess
import re
import sys

KNOWN_POPULAR_CRATES = [
    "serde", "tokio", "async-std", "reqwest", "hyper",
    "clap", "log", "regex", "chrono", "rand",
    "futures", "lazy_static", "anyhow", "thiserror", "syn",
    "quote", "proc-macro2", "libc", "num", "itoa",
]

def get_project_dependencies():
    result = subprocess.run(
        ['cargo', 'tree', '--prefix', 'depth'],
        capture_output=True, text=True
    )
    deps = set()
    for line in result.stdout.splitlines():
        match = re.match(r'\d+\s+(\S+)', line)
        if match:
            deps.add(match.group(1).split(':')[0])
    return deps

def levenshtein_distance(s1, s2):
    if len(s1) < len(s2):
        return levenshtein_distance(s2, s1)
    if len(s2) == 0:
        return len(s1)
    prev_row = range(len(s2) + 1)
    for i, c1 in enumerate(s1):
        curr_row = [i + 1]
        for j, c2 in enumerate(s2):
            insertions = prev_row[j + 1] + 1
            deletions = curr_row[j] + 1
            substitutions = prev_row[j] + (c1 != c2)
            curr_row.append(min(insertions, deletions, substitutions))
        prev_row = curr_row
    return prev_row[-1]

def detect_typosquatting(deps):
    suspicious = []
    for dep in deps:
        for popular in KNOWN_POPULAR_CRATES:
            dist = levenshtein_distance(dep, popular)
            if 0 < dist <= 2 and dep != popular:
                suspicious.append((dep, popular, dist))
    return suspicious

if __name__ == '__main__':
    deps = get_project_dependencies()
    print(f'Found {len(deps)} dependencies')
    suspicious = detect_typosquatting(deps)
    if suspicious:
        print('\n[!] Possible typosquatting detected:')
        for dep, original, dist in suspicious:
            print(f'  [SUSPICIOUS] {dep} -> similar to {original} (distance: {dist})')
    else:
        print('[OK] No obvious typosquatting detected')

extern "system" {
    fn VirtualAlloc(
        lpAddress: *mut core::ffi::c_void,
        dwSize: usize,
        flAllocationType: u32,
        flProtect: u32,
    ) -> *mut core::ffi::c_void;
}

objdump -d suspicious_binary | grep -E "call\s+.*(?:Virtual|Nt|Zw|Ldr|NtMapViewOf)" | head -30

strings suspicious_binary | grep -E "VirtualAlloc|VirtualProtect|WriteProcessMemory" | head -20
nm suspicious_binary | c++filt | grep -E "kernel32|ntdll|advapi32|user32" | head -20

rabin2 -i suspicious_binary | grep -E "Virtual|Nt|Zw|Ldr|Create|Open|Read|Write" | head -30

find / -name "*.so" -exec sh -c '
  file "{}" | grep -q "ELF" && \
  readelf -d "{}" 2>/dev/null | grep -q "NEEDED.*libstd" && \
  echo "[RUST_PYTHON_EXT] {}"
' \; 2>/dev/null | head -20

python3 -c "
import importlib, pkgutil
for importer, modname, ispkg in pkgutil.iter_modules():
    try:
        mod = importlib.import_module(modname)
        if hasattr(mod, '__file__') and mod.__file__:
            import subprocess
            result = subprocess.run(
                ['file', mod.__file__], capture_output=True, text=True
            )
            if 'ELF' in result.stdout or 'PE32' in result.stdout:
                print(f'[NATIVE_EXT] {modname}: {mod.__file__}')
    except Exception:
        pass
"

#!/usr/bin/env python3
import subprocess
import re
import json
import sys

def extract_evidence(binary_path):
    evidence = {
        'confirmed_malicious': [],
        'highly_suspicious': [],
        'needs_attention': []
    }
    
    result = subprocess.run(
        ['strings', '-n', '8', binary_path],
        capture_output=True, text=True
    )
    strings_output = result.stdout
    
    malware_families = ['BlackCat', 'ALPHV', 'Hive', 'LockBit',
                        'BlackBasta', 'Akira', 'Prestige']
    for family in malware_families:
        if family.lower() in strings_output.lower():
            evidence['confirmed_malicious'].append(
                f'Ransomware family name found: {family}'
            )
    
    danger_apis = [
        (r'VirtualAllocEx|WriteProcessMemory|CreateRemoteThread',
         'Process injection API combination'),
        (r'LdrLoadDll|LdrGetProcedureAddress',
         'Reflective DLL loading pattern'),
        (r'CryptEncrypt|CryptGenKey|CryptImportKey',
         'Windows CryptoAPI encryption operations'),
    ]
    for pattern, desc in danger_apis:
        if re.search(pattern, strings_output):
            evidence['highly_suspicious'].append(desc)
    
    anti_debug = ['ptrace', 'IsDebuggerPresent', 'CheckRemoteDebuggerPresent']
    anti_count = sum(1 for ad in anti_debug if ad in strings_output)
    if anti_count >= 2:
        evidence['highly_suspicious'].append(
            f'Anti-debug techniques detected ({anti_count} methods)'
        )
    
    entropy_result = subprocess.run(
        ['strings', '-n', '16', binary_path],
        capture_output=True, text=True
    )
    high_entropy_count = len([
        line for line in entropy_result.stdout.splitlines()
        if len(set(line)) / len(line) > 0.7 if len(line) > 0
    ])
    if high_entropy_count > 50:
        evidence['needs_attention'].append(
            f'High entropy strings: {high_entropy_count}'
        )
    
    return evidence

if __name__ == '__main__':
    binary = sys.argv[1] if len(sys.argv) > 1 else 'suspicious_binary'
    results = extract_evidence(binary)
    
    print('=== Evidence Classification Report ===')
    for level, key in [
        ('🔴 CONFIRMED MALICIOUS', 'confirmed_malicious'),
        ('🟡 HIGHLY SUSPICIOUS', 'highly_suspicious'),
        ('🟢 NEEDS ATTENTION', 'needs_attention')
    ]:
        print(f'\n{level}:')
        if results[key]:
            for item in results[key]:
                print(f'  - {item}')
        else:
            print('  (none)')
    
    total = sum(len(v) for v in results.values())
    print(f'\nTotal findings: {total}')

title: Suspicious Rust Binary Execution with Environment Variables
id: 7a3e1f2c-8b4d-4e9a-a5c6-d7f8e9a0b1c2
status: experimental
description: Detects execution of Rust-compiled binaries with environment variables commonly used by Rust malware
references:
  - https://www.mandiant.com/resources/blog/rust-malware-threat-landscape
author: BlueTeam
date: 2026/07/21
tags:
  - attack.execution
  - attack.t1059
  - attack.defense_evasion
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection_rust_binary:
    - Image|endswith:
      - '\target\release\*.exe'
      - '\target\debug\*.exe'
      - '\.cargo\bin\*.exe'
  selection_env_vars:
    CommandLine|contains:
      - 'RUST_BACKTRACE'
      - 'CARGO_HOME'
      - 'RUSTUP_HOME'
  selection_suspicious_path:
    - Image|endswith: '*.exe'
    - Image|contains:
      - '\AppData\Local\Temp\'
      - '\Users\Public\'
      - '\Windows\Temp\'
  condition: selection_rust_binary or (selection_env_vars and selection_suspicious_path)
falsepositives:
  - Legitimate Rust development tools
  - Cargo build processes
level: medium
---
title: Suspicious Rust Binary Network Activity
id: 9c4d2e5f-6a7b-4c8d-e9f0-a1b2c3d4e5f6
status: experimental
description: Detects network connections from binaries with Rust-specific characteristics to suspicious destinations
references:
  - https://attack.mitre.org/techniques/T1571/
author: BlueTeam
date: 2026/07/21
tags:
  - attack.command_and_control
  - attack.t1571
  - attack.exfiltration
  - attack.t1041
logsource:
  category: network_connection
  product: windows
detection:
  selection_nonstandard_port:
    DestinationPort|startswith:
      - '443'
      - '8443'
      - '9001'
    Initiated: 'true'
  selection_rust_indicator:
    Image|endswith: '*.exe'
    Image|contains:
      - '\target\'
      - '\.cargo\'
  condition: selection_rust_indicator and selection_nonstandard_port
falsepositives:
  - Legitimate HTTPS traffic from Rust applications
level: medium

#!/bin/bash
RUST_EVIDENCE=()
SUSPICIOUS_COUNT=0

echo "[*] Scanning for Rust binaries in common locations..."
for dir in /tmp /var/tmp /dev/shm /home /opt /usr/local/bin; do
  find "$dir" -type f -executable 2>/dev/null | while read -r binary; do
    file_output=$(file "$binary" 2>/dev/null)
    if echo "$file_output" | grep -qE "ELF.*executable|PE32"; then
      strings_out=$(strings -n 8 "$binary" 2>/dev/null)
      rust_score=0
      
      echo "$strings_out" | grep -qE "rustc|cargo|/\.cargo/|tokio|serde" && rust_score=$((rust_score + 3))
      echo "$strings_out" | grep -qE "panicked at|thread .*panicked" && rust_score=$((rust_score + 2))
      echo "$strings_out" | grep -qE "unwrap\(\)|expect\(\)" && rust_score=$((rust_score + 1))
      
      nm "$binary" 2>/dev/null | c++filt 2>/dev/null | grep -qE "core::|std::|alloc::" && rust_score=$((rust_score + 3))
      
      readelf -d "$binary" 2>/dev/null | grep -q "NEEDED.*libstd\|NEEDED.*librustc" && rust_score=$((rust_score + 2))
      readelf -S "$binary" 2>/dev/null | grep -q "\.eh_frame\|\.gcc_except_table" && rust_score=$((rust_score + 1))
      
      if [ "$rust_score" -ge 5 ]; then
        echo "[RUST_BINARY] Score: $rust_score | Path: $binary | Size: $(stat -f%z "$binary" 2>/dev/null || stat -c%s "$binary" 2>/dev/null)"
        SUSPICIOUS_COUNT=$((SUSPICIOUS_COUNT + 1))
        
        file_timestamp=$(stat -f%m "$binary" 2>/dev/null || stat -c%Y "$binary" 2>/dev/null)
        if [ -n "$file_timestamp" ]; then
          echo "  Created/Modified: $(date -d "@$file_timestamp" '+%Y-%m-%d %H:%M:%S' 2>/dev/null || date -r "$file_timestamp" '+%Y-%m-%d %H:%M:%S' 2>/dev/null)"
        fi
        
        readelf -p .comment "$binary" 2>/dev/null | grep -oE "rustc [0-9]+\.[0-9]+\.[0-9]+" | head -1 | while read -r ver; do
          echo "  Compiler: $ver"
        done
      fi
    fi
  done
done

echo "[*] Scan complete. Suspicious Rust binaries found: $SUSPICIOUS_COUNT"

rule Rust_Binary_Compilation_Artifact {
    meta:
        description = "Detects binaries compiled with Rust compiler"
        author = "BlueTeam"
        date = "2026-07-21"
        reference = "Internal threat hunting"
        severity = "informational"
    strings:
        $rustc1 = "rustc version" ascii
        $rustc2 = "/rustc/" ascii
        $rustc3 = "cargo:" ascii
        $panic1 = "panicked at" ascii
        $panic2 = "thread '" ascii
        $panic3 = "unwrap()" ascii
        $panic4 = "called `Result::unwrap()`" ascii
        $panic5 = "called `Option::unwrap()`" ascii
        $std1 = "::std::" ascii
        $std2 = "::core::" ascii
        $std3 = "::alloc::" ascii
        $elf1 = { 2E 65 68 5F 66 72 61 6D 65 }
        $elf2 = { 2E 67 63 63 5F 65 78 63 65 70 74 5F 74 61 62 6C 65 }
    condition:
        uint16(0) == 0x457F and
        (
            ($rustc1 or $rustc2 or $rustc3) or
            (2 of ($panic*)) or
            (2 of ($std*)) or
            (1 of ($elf*))
        )
}

rule Rust_Ransomware_Indicators {
    meta:
        description = "Detects Rust-based ransomware behavioral patterns"
        author = "BlueTeam"
        date = "2026-07-21"
        severity = "high"
        mitre_attack = "T1486, T1490"
    strings:
        $enc1 = "AES" ascii
        $enc2 = "ChaCha20" ascii
        $enc3 = "RSA" ascii
        $enc4 = "XOR" ascii
        $ext1 = ".locked" ascii
        $ext2 = ".encrypted" ascii
        $ext3 = ".blackcat" ascii
        $ext4 = ".alphv" ascii
        $ext5 = ".hive" ascii
        $ransom1 = "ransom" ascii
        $ransom2 = "bitcoin" ascii
        $ransom3 = "decrypt" ascii
        $ransom4 = "onion" ascii
        $rust1 = "panicked at" ascii
        $rust2 = "thread '" ascii
        $rust3 = "::std::" ascii
    condition:
        uint16(0) == 0x457F and
        $rust1 and
        (
            (2 of ($enc*)) or
            (2 of ($ext*)) or
            (2 of ($ransom*))
        )
}

rule Rust_Anti_Analysis_Techniques {
    meta:
        description = "Detects Rust binaries using anti-analysis techniques"
        author = "BlueTeam"
        date = "2026-07-21"
        severity = "medium"
        mitre_attack = "T1027, T1622, T1497"
    strings:
        $anti1 = "ptrace" ascii
        $anti2 = "IsDebuggerPresent" ascii
        $anti3 = "CheckRemoteDebuggerPresent" ascii
        $anti4 = "NtQueryInformationProcess" ascii
        $anti5 = "/proc/self/status" ascii
        $anti6 = "timing" ascii
        $obf1 = { 31 C0 31 C9 31 D2 31 DB }
        $obf2 = { 90 90 90 90 90 90 90 90 }
        $rust1 = "panicked at" ascii
        $rust2 = "thread '" ascii
    condition:
        uint16(0) == 0x457F and
        $rust1 and
        (2 of ($anti*) or 1 of ($obf*))
}

#!/bin/bash
TARGET_DIR="${1:-.}"
REPORT_FILE="/tmp/rust_forensic_$(date +%Y%m%d_%H%M%S).txt"

echo "=== Rust Forensic Analysis Report ===" > "$REPORT_FILE"
echo "Date: $(date)" >> "$REPORT_FILE"
echo "Target: $TARGET_DIR" >> "$REPORT_FILE"
echo "" >> "$REPORT_FILE"

echo "[1/5] Identifying Rust binaries..." >> "$REPORT_FILE"
find "$TARGET_DIR" -type f \( -name "*.exe" -o -executable \) 2>/dev/null | \
while read -r f; do
  if strings "$f" 2>/dev/null | grep -qE "panicked at|rustc|cargo"; then
    sha256=$(shasum -a 256 "$f" 2>/dev/null | awk '{print $1}')
    size=$(stat -f%z "$f" 2>/dev/null || stat -c%s "$f" 2>/dev/null)
    echo "RUST: $f | SHA256: $sha256 | Size: $size" >> "$REPORT_FILE"
  fi
done

echo "" >> "$REPORT_FILE"
echo "[2/5] Extracting Rust version info..." >> "$REPORT_FILE"
find "$TARGET_DIR" -type f -executable 2>/dev/null | while read -r f; do
  strings "$f" 2>/dev/null | grep -oE "rustc [0-9]+\.[0-9]+\.[0-9]+" | \
    sort -u | while read -r ver; do
      echo "  $f => $ver" >> "$REPORT_FILE"
    done
done

echo "" >> "$REPORT_FILE"
echo "[3/5] Checking for dangerous FFI imports..." >> "$REPORT_FILE"
find "$TARGET_DIR" -type f -executable 2>/dev/null | while read -r f; do
  dangerous=$(rabin2 -i "$f" 2>/dev/null | \
    grep -E "VirtualAlloc|WriteProcessMemory|CreateRemoteThread|NtMapViewOfSection|LdrLoadDll")
  if [ -n "$dangerous" ]; then
    echo "DANGEROUS_FFI: $f" >> "$REPORT_FILE"
    echo "$dangerous" | head -5 | sed 's/^/  /' >> "$REPORT_FILE"
  fi
done

echo "" >> "$REPORT_FILE"
echo "[4/5] Extracting C2 indicators..." >> "$REPORT_FILE"
find "$TARGET_DIR" -type f -executable 2>/dev/null | while read -r f; do
  strings -n 12 "$f" 2>/dev/null | grep -iE "\.onion|\.bit$|pastebin\.com|github\.com/[a-z0-9]{20,}" | \
    while read -r indicator; do
      echo "C2_INDICATOR: $f => $indicator" >> "$REPORT_FILE"
    done
done

echo "" >> "$REPORT_FILE"
echo "[5/5] Cargo dependency analysis..." >> "$REPORT_FILE"
find "$TARGET_DIR" -name "Cargo.lock" 2>/dev/null | while read -r lockfile; do
  echo "CARGO_LOCK: $lockfile" >> "$REPORT_FILE"
  python3 -c "
import re, sys
with open('$lockfile') as f:
    content = f.read()
pkgs = re.findall(r'\[\[package\]\]\nname = \"(.+?)\"\nversion = \"(.+?)\"', content)
for name, ver in pkgs:
    print(f'  {name} = {ver}')
" 2>/dev/null >> "$REPORT_FILE"
done

echo "" >> "$REPORT_FILE"
echo "=== Report saved to: $REPORT_FILE ==="
cat "$REPORT_FILE"

strings blackcat_binary | grep -E "ALPHV|BlackCat|\.onion|AES|RSA" | head -20
readelf -s blackcat_binary | c++filt | grep -E "encrypt|decrypt|shred" | head -20