ReckleGonzales/antirescan

离线 PE 恶意软件检测引擎。支持针对 Windows PE 文件的类 YARA 规则匹配， 使用 Rust 编写 —— 快速、准确、零网络依赖。 ``` ▸ scan sample.exe [match] RANSOMWARE [critical] CryptEncrypt, CryptGenKey, FindFirstFileW [match] PROC_INJECTION [high] VirtualAllocEx, WriteProcessMemory, CreateRemoteThread [match] KEYLOGGER [high] SetWindowsHookExW, GetAsyncKeyState [match] C2_BEACON [medium] Sleep, InternetOpenA [match] DATA_EXFIL [medium] HttpSendRequestA, ReadFile [analysis] risk_score: 100 / predict: malicious ✓ ``` ## 架构 ``` antirescan/ ├── crates/ │ ├── antirescan-core/ # Engine core: PE parser, rule engine, scanner, reporter │ ├── antirescan-cli/ # CLI binary with ASCII banner and colored output │ └── antirescan-rules/ # 10 built-in detection rules (embedded JSON) ``` ## 快速开始 ``` cargo build --release ./target/release/antirescan-cli sample.exe ./target/release/antirescan-cli sample.exe --verbose # show full JSON report ``` ## 内置规则 (10) | 规则 | 严重程度 | 检测方式 | |------|----------|-----------| | PROC_INJECTION | high | VirtualAllocEx + WriteProcessMemory + CreateRemoteThread | | RANSOMWARE | critical | CryptEncrypt + CryptGenKey + file enumeration | | KEYLOGGER | high | SetWindowsHookExW + GetAsyncKeyState | | DOWNLOADER | medium | URLDownloadToFileA + WinINet APIs | | PERSISTENCE | high | Registry run keys, service creation | | PRIVESC | high | AdjustTokenPrivileges + SeDebugPrivilege | | REVERSE_SHELL | high | Winsock sockets + process creation | | C2_BEACON | medium | Sleep + internet connectivity | | DATA_EXFIL | medium | HTTP send + file read APIs | | PACKED_UPX | medium | UPX section signatures | ## 自定义规则 规则是 JSON 文件。使用 `--rules ` 加载自定义规则及内置规则。 ``` { "name": "MY_RULE", "description": "Detects something", "severity": "high", "weight": 7, "conditions": [ { "type": "Imports", "functions": ["MyFunction"], "logic": "any" } ], "reasons_template": ["MyFunction detected"] } ``` ## 许可证 MIT

标签：Homebrew安装, IP 地址批量处理, PE文件分析, Rust, YARA, 云安全监控, 云资产可视化, 可视化界面, 文档结构分析, 网络信息收集, 网络流量审计, 自定义DNS解析器, 通知系统, 静态分析