如何打造一款自己的恶意样本检测工具

rule php_webshell {   meta:      description = "php_webshell"      author = "shuoshuren"      reference = "http://python.vin"      date = "2020-12-27"   strings:      $s1 = "eval()"      $s2 = "assert()"      $s3 = "exec()"       $s4 = "system()"   condition:      $1 or $2 or $3 or $4}

python3 yarGen.py -m /Users/ssr/说书人/python/小工具/yara扫描/webshell

rule _xunyi2_xunyi_2_shell_ma_ssr_3 {   meta:      description = "webshell - from files xunyi2.php, xunyi 2.php, shell.php, ma_ssr.php"      author = "yarGen Rule Generator"      reference = "https://github.com/Neo23x0/yarGen"      date = "2020-12-27"      hash1 = "6207e87b96dc50ec1e59184db9c6fd977471064e611e062ba7c7db02047575b9"      hash2 = "8a2919e0e3720f047100dbe5584346935cff53d27a09791a7021f34576b3ce87"      hash3 = "f5bf5fe917b293f5e5905b9dd7f5a2c27e1743fd700a4722ed5641d00394a701"      hash4 = "a90618cfd113cafa55e0f9271769a939fdb49a7d4b555bc247d65ea3a8aedbc3"   strings:      $s1 = "if (isset($_GET['pass']))" fullword ascii      $s2 = "    $_SESSION['k']=$key;" fullword ascii      $s3 = "    $key=$_SESSION['k'];" fullword ascii      $s4 = "    print $key;" fullword ascii      $s5 = "    $key=substr(md5(uniqid(rand())),16);" fullword ascii   condition:      ( uint16(0) == 0x3f3c and filesize < 2KB and ( all of them )      ) or ( all of them )}

pip install yara-python

# -*- coding:utf-8 -*- -import osimport timeimport yaraimport sysimport prettytable as pt
def static_scan(path):    webshell = pt.PrettyTable()    webshell.field_names = ['Path', 'LastChange']    webshell.align["Path"] = "l"  # 路径字段靠右显示    rule = yara.compile(filepath=r'yargen_rules.yar')#yara规则库路径，如果有多个可以做成索引文件    print('33[1;34m读取待检测文件中...33[0m')    all = os.popen("find " + path).read().split('n')    file_list = []  # 过滤后的文件列表    print('33[1;32m读取完毕，开始过滤...33[0m')    for file in all:  # 过滤掉部分文件        try:            fsize = os.path.getsize(file) / float(1024 * 1024)        except:            fsize = 6        if fsize <= 5:  # 只检测小于5M的文件            file_list.append(file)    print('33[1;32m过滤完毕，开始扫描...33[0m')    for i in range(len(file_list)):        sys.stdout.write('33[K' + 'r')        print('r','[{0}/{1}]检测中,耐心等待哦~'.format(str(i), str(len(file_list))),end=' ')        try:            with open(file_list[i], 'rb') as f:                matches = rule.match(data=f.read())        except:            matches = []        try:            if matches != []:                time_chuo = time.localtime(os.path.getmtime(file_list[i]))  # 最后修改时间戳                lasttime = time.strftime("%Y--%m--%d %H:%M:%S", time_chuo)  # 最后修改时间                warning = ('33[1;31mn告警：检测到标签{0}，文件位置{1}33[0m'.format(matches, file_list[i]))                webshell.add_row([file_list[i], lasttime])                print(warning)        except:            pass    print('33[1;32mn所有文件扫描完成，结果如下：n33[0m')    print(webshell)
static_scan('webshell')