Security audit
Security checks for vulnerabilities and agentic risk
This log analyzer needs review because installation can update several agents without the promised confirmation, and report output can overwrite source logs.
Choose one explicit --agent or --dir and preview with --dry-run; avoid default or global installation until its confirmation behavior is fixed. Back up existing skill files. Analyze read-only log copies, specify individual files to avoid unexpected recursion, and save reports to a new file outside the inputs. Reports contain original log evidence. The scanner's installer gaps were independently investigated; actual installations and external npm releases were not tested. Prefer the reviewed bundle or a pinned release over unversioned npx commands.
.Installers do not enforce the documented multi-target confirmation boundary
A default invocation can replace Skill contents across multiple agent installations without the promised target selection or confirmation, affecting subsequent agent sessions and removing existing installation files.
YARA rule matched a known webshell pattern (PHP, Python, JSP, or ASPX webshell).
pinfo.php`、`/phpunit`、`/actuator`、`/console`、`/backup`、`/dump`、`/test`、`/explorer`、`/vendor`、`/config`、`/server-status`、`/server-info`、`/xmlrpc.php`、`/webdav`、`/shell`、`/shell.php`、`/cmd`、`/debug`、`/xdebug` 等。
### webshell 路径片段（WEBSHELL_PATH）
`/shell.php`、`/cmd.php`、`/eval`、`/webshell`、`/backdoor`、`/c99.php`、`/r57.php`、`/wso`、`/b374k`、`/uploads/shell`、`/hack.php`、`/shell.asp`、`/shell.jsp`、`/jsp/cmd`、`/marco` 等。
### 路径遍历特征（TRAVERSAL）
`../`、`..%2f`、`..%5c`、`%2e%2e%2f`、`%2e%2e%5c`、`%252e%252e`、`..%2F`、`..%252f`、`%c0%ae%c0%ae`、`%c0%ae`、`dotdot`。
### SQL 注入特征（SQLI）
`union select`、`or 1=1`、`or 1=1--`、`1=1`、`sleep(`、`benchmark(`、`information_schema`、`@@version`、`concat(`、`group_concat`、`or '1'='1`、`union all select`、`procedure analyse`、`and 1=1`、`waitfor delay`、`pg_sleep`、`into outfile`、`xp_cmdshell`、`%27`、`'%20or%20`
YARA rule matched a known webshell pattern (PHP, Python, JSP, or ASPX webshell).
", "/test",
"/explorer", "/vendor", "/config", "/server-status", "/server-info",
"/xmlrpc.php", "/.well-known", "/robots.txt", "/webdav", "/shell",
"/shell.php", "/cmd", "/debug", "/xdebug", "/phpmyadmin",
]
# 可疑 webshell 相关路径片段（上传 / 执行）
WEBSHELL_PATH = [
"/shell.php", "/cmd.php", "/eval", "/webshell", "/backdoor",
"/c99.php", "/r57.php", "/wso", "/b374k", "/uploads/shell",
"/hack.php", "/shell.asp", "/shell.jsp", "/jsp/cmd", "/marco",
]
# 路径遍历特征
TRAVERSAL = ["../", "..%2f", "..%5c", "%2e%2e%2f", "%2e%2e%5c", "%252e%252e",
"..%2F", "..%252f", "%c0%ae%c0%ae", "%c0%ae", "dotdot"]
# SQL 注入特征（小写、子串匹配）
SQLI = ["union select", "or 1=1", "or 1=1--", "1=1", "sleep(", "benchmark(",
"information_schema", "@@version", "concat(", "group_concat",
"' or '", "or '1'='1", "union all select", "procedure analyse",
"and 1=1", "waitfor delay", "pg_sleep", "0x3a", "load_file(",
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
| auth | credential_stuffing | high | One source tries many different usernames |
| auth | abnormal_login | high | Multiple failures then a success from the same source |
| auth | root_login | medium | Direct login as root from a source |
| auth | sudo_escalation / sudo_attempt | medium~high | sudo escalation / privilege attempt (not in sudoers) |
| web | path_traversal | high | Path traversal (../ or encoded variants) |
| web | sql_injection | high | SQL injection patterns |
| web | webshell_upload | critical | webshell upload / access trace |
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
| auth | credential_stuffing | high | 同源尝试多个不同用户名 |
| auth | abnormal_login | high | 同源多次失败后成功登录 |
| auth | root_login | medium | 来源以 root 直登 |
| auth | sudo_escalation / sudo_attempt | medium~high | sudo 提权 / 越权（not in sudoers） |
| web | path_traversal | high | 路径穿越（../ 或编码变体） |
| web | sql_injection | high | SQL 注入特征 |
| web | webshell_upload | critical | webshell 上传 / 访问轨迹 |
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
| auth | credential_stuffing | high | 同源尝试多个不同用户名 |
| auth | abnormal_login | high | 同源多次失败后成功登录 |
| auth | root_login | medium | 来源以 root 直登 |
| auth | sudo_escalation / sudo_attempt | medium~high | sudo 提权 / 越权（not in sudoers） |
| web | path_traversal | high | 路径穿越（../ 或编码变体） |
| web | sql_injection | high | SQL 注入特征 |
| web | webshell_upload | critical | webshell 上传 / 访问轨迹 |
The supplied chunk has an installation purpose rather than the declared log-analysis purpose. Although installation can support a skill, these behaviors go beyond incidental implementation details under the explicit read-only boundary: installTo() and copyDir() create directories and overwrite files, while cleanResidue() and safeRemove() delete installation artifacts. These operations affect skill directories, not log contents; there is no evidence that this chunk modifies logs, accesses the network, or actively scans systems. The mismatch is the undeclared filesystem-mutating installation behavior, not evidence of malicious intent. Other, unsupplied files may implement the advertised analysis capabilities.
Installation can be a supporting activity, but this chunk implements filesystem deployment and cleanup with material side effects beyond the declared read-only scope. install_to and copy_tree use mkdir and cp, while clean_residue uses rm -rf and find -delete on existing installation contents. No log parsing, detection, timeline generation, or report generation appears in the supplied code. There is no evidence of networking, active scanning, or modification of input logs; the mismatch concerns undisclosed installation writes and deletions, not malicious intent.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
典型行（combined）：
10.0.0.9 - - [05/Jan/2026:12:00:01 +0000] "GET /../../etc/passwd HTTP/1.1" 404 123 "-" "curl/7.64"
引擎解析来源 IP、时间、方法、URI、状态码、User-Agent。URI 会先做 URL 解码（unquote）再做特征匹配，因此 union%20select / %2e%2e%2f 也能命中。
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
��务创建 | task_created | 出现 4698 | medium | 计划任务持久化；核对任务动作与触发条件 |
> 同一条事件可能同时命中多条规则（如 4624 同时触发 rdp_logon + admin_logon + abnormal_login），
> 这是正常行为，便于逐条复核，不影响时间线去重。
## 可疑进程特征（EventID 4688）
| 特征 | 默认严重度 | 说明 |
|---|---|---|
| mimikatz / lsass / procdump | critical~high | 凭据窃取 / 内存转储 |
| downloadstring / frombase64string / -enc / -windowstyle hidden | high | 下载执行 / 编码命令 / 隐藏窗口执行 |
| mshta / certutil -urlcache / regsvr32 /s / rundll32 javascript / bitsadmin /transfer | high | LOLBin 远程加载 / 下载执行 |
| powershell / pwsh / cmd /c / wscript / cscript / schtasks /create / sc create | medium | 脚本宿主 / 持久化命令 |
| whoami / taskkill /f / net user | low~medium | 侦察 / 账户管理（需结合上下文） |
## 阈值与调参
- 4625 聚合复用 `--m
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
SCANNER_PATH = [
"/wp-login.php", "/wp-admin", "/wp-content", "/administrator",
"/phpmyadmin", "/pma", "/mysql", "/admin", "/login", "/manager",
"/cgi-bin", "/.git", "/.env", "/.svn", "/.htaccess", "/phpinfo.php",
"/phpunit", "/actuator", "/console", "/backup", "/dump", "/test",
"/explorer", "/vendor", "/config", "/server-status", "/server-info",
"/xmlrpc.php", "/.well-known", "/robots.txt", "/webdav", "/shell",
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
��块包含混淆特征（iex / -enc / [char] / 字符串拼接 / 格式化等），"
"可能用于规避检测。建议：尝试解码还原后人工核实。",
evidence=evid, time_value=ev.get("ts")))
return findings
# Windows 事件日志可疑进程特征：(匹配子串, 说明, 严重度)。按严重度从高到低匹配。
SUSPICIOUS_PROCESS = [
("mimikatz", "凭据窃取工具（Mimikatz）", "critical"),
("lsass", "LSASS 进程访问（凭据窃取）", "critical"),
("downloadstring", "下载内容并执行", "critical"),
("procdump", "内存转储（可能窃取凭据）", "high"),
("frombase64string", "Base64 解码执行", "high"),
("mshta", "MSHTA 脚本宿主（可加载远程内容）", "high"),
("certutil -urlcache", "CertUtil 下载执行", "high"),
("certutil -decode", "CertUtil 解码执行", "high"),
("regsvr32 /s", "Regsvr32 静默注册（可远程加载）", "high"),
("rundll32 javascr
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
YottaMeta 自有实现首版（安全日志分析方向参考开源社区 detection-engineering / logging-monitoring 类技能思路，已完全重写，零依赖）：
- **零依赖自研引擎**（scripts/yotta_logwatch.py，Python 3.8+ 标准库）：解析 auth/secure、Web 访问日志（common/combined）、PowerShell 脚本块日志；类型自动嗅探；只读本地、离线检测。
- **auth 检测**：失败登录聚合 / 同源爆破（--max-fail）/ 时间窗内多账号撞库 / 异常登录（失败后成功）/ root 直登 / sudo 提权与越权（not in sudoers）。
- **web 检测**：404 洪峰（--404-threshold）/ 扫描器探测特征 / webshell 上传·访问轨迹 / 路径遍历 / SQL 注入 / 可疑 User-Agent。
- **powershell 检测**：编码命令 / 下载执行 / 反射加载 / AMSI 绕过 / 混淆启发式。
- **输出**：文本 / JSON（stdout 纯净）/ Markdown 报告；时间线 + 命中规则中文说明 + 复核建议。
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
## Core value
- **Zero-dependency engine** — four log parsers + detection rules built entirely with Python 3.8+ standard library; no SIEM or external scanners.
- **Four log families** — auth/secure (brute-force / abnormal login / sudo escalation), Web access logs (scans / webshell / traversal / SQLi / suspicious UA), PowerShell script blocks (encoded / download-execute / reflection / AMSI bypass / obfuscation), Windows Event Log (login failures / abnormal login / account ops / log clearing / suspicious process).
- **Automatic type sniffing** — no need to specify the log type; it judges by line heuristics, or force it with `--type`.
- **Timeline + Chinese explanations** — hits are sorted by time; each includes type, severity, evidence line, Chinese explanation and a review suggestion.
- **Three output modes** — text / JSON (clean stdout) / Markdown report; `--output` writes to a file.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| auth | credential_stuffing | high | One source tries many different usernames |
| auth | abnormal_login | high | Multiple failures then a success from the same source |
| auth | root_login | medium | Direct login as root from a source |
| auth | sudo_escalation / sudo_attempt | medium~high | sudo escalation / privilege attempt (not in sudoers) |
| web | path_traversal | high | Path traversal (../ or encoded variants) |
| web | sql_injection | high | SQL injection patterns |
| web | webshell_upload | critical | webshell upload / access trace |
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
## 核心价值
- **零依赖自研**：四类日志解析 + 检测规则全部用 Python 3.8+ 标准库实现，不依赖 SIEM / 外部扫描器。
- **四类日志覆盖**：auth/secure（爆破 / 异常登录 / sudo 提权）、Web 访问日志（扫描 / webshell / 遍历 / SQLi / 可疑 UA）、PowerShell 脚本块（编码 / 下载执行 / 反射 / AMSI 绕过 / 混淆）、Windows 事件日志（登录失败 / 异常登录 / 账户操作 / 日志清空 / 可疑进程）。
- **类型自动嗅探**：无需手动指定日志类型，按行特征自动判断；也可 `--type` 强制。
- **时间线 + 中文说明**：命中按时间排序，每条含类型、严重度、证据行、中文说明与复核建议。
- **三种输出**：文本 / JSON（stdout 纯净）/ Markdown 报告；`--output` 可写文件。
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| auth | credential_stuffing | high | 同源尝试多个不同用户名 |
| auth | abnormal_login | high | 同源多次失败后成功登录 |
| auth | root_login | medium | 来源以 root 直登 |
| auth | sudo_escalation / sudo_attempt | medium~high | sudo 提权 / 越权（not in sudoers） |
| web | path_traversal | high | 路径穿越（../ 或编码变体） |
| web | sql_injection | high | SQL 注入特征 |
| web | webshell_upload | critical | webshell 上传 / 访问轨迹 |
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
## 何时使用
- 用户给出登录日志（/var/log/auth.log、secure、journal 等）要排查登录爆破 / 异常登录 / sudo 提权；
- 给出 Web 访问日志（nginx / apache common|combined）要排查扫描 / webshell / 路径遍历 / SQL 注入 / 可疑 UA；
- 给出 PowerShell 脚本块日志要排查编码命令 / 下载执行 / 反射加载 / AMSI 绕过 / 混淆；
- 给出 Windows 事件日志（Security/System，key=value / wevtutil 文本 / XML 导出）要排查登录爆破 / 异常登录 / 账户操作 / 日志清空 / 可疑进程；
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- **四类日志解析**：auth/secure（sshd / login / sudo…）、Web 访问日志（common/combined）、PowerShell 脚本块日志、Windows 事件日志（Security/System，key=value / wevtutil 文本 / XML 单行导出）；
- **类型自动嗅探**：无需手动指定，按行特征判断类型；也可 `--type` 强制；
- **auth 检测**：失败登录聚合 / 同源爆破 / 时间窗内多账号撞库 / 异常登录（失败后成功）/ root 直登 / sudo 提权与越权尝试；
- **web 检测**：404 洪峰 / 扫描器探测特征 / webshell 上传·访问轨迹 / 路径遍历 / SQL 注入 / 可疑 User-Agent；
- **powershell 检测**：编码命令 / 下载执行 / 反射加载 / AMSI 绕过 / 混淆启发式；
- **winevt 检测**：登录失败聚合（爆破 / 撞库）/ 异常·管理员·RDP 登录 / 账户创建·删除·锁定 / 组成员添加 / 安全日志清空 / 可疑进程创建 / 新服务安装 / 计划任务创建；
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| auth | credential_stuffing | high | 同源尝试多个不同用户名 |
| auth | abnormal_login | high | 同源多次失败后成功登录 |
| auth | root_login | medium | 来源以 root 直登 |
| auth | sudo_escalation / sudo_attempt | medium~high | sudo 提权 / 越权（not in sudoers） |
| web | path_traversal | high | 路径穿越（../ 或编码变体） |
| web | sql_injection | high | SQL 注入特征 |
| web | webshell_upload | critical | webshell 上传 / 访问轨迹 |
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# auth 日志检测规则（元察 · 元）
分析 /var/log/auth.log、/var/log/secure、journal 中 sshd / login / sudo 等认证日志。本文件说明元察的 auth 检测规则与阈值，供人工复核与调参。
## 输入形态
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| brute_force | 同来源失败登录次数 >= `--max-fail`（默认 5），或在 `--window`（默认 300 秒）内达标 | low→high（次数越多越高） | 核实来源是否合法；临时封禁；确认是否存在弱口令账户 |
| credential_stuffing | 同来源在日志中尝试了 2 个及以上不同用户名 | high | 撞库 / 用户名枚举；启用来源限速与失败锁定 |
| abnormal_login | 同来源先失败后成功登录 | high | 爆破成功后接管；立即核查会话、重置密码 |
| root_login | 以 root 身份直接登录 | medium | 若来源非预期应重点核查；改用受限账户 + sudo |
| sudo_escalation | `sudo:` + `COMMAND=` / `session opened for user` | medium | 核对执行者与命令；确保 sudoers 最小化授权 |
| sudo_attempt | `sudo:` + `not in sudoers` | high | 越权尝试；横向移动 / 提权迹象；核查来源与 sudoers |
| invalid_user | 出现 `invalid user` | medium | 对不存在的账户发起登录；用户名枚举前兆 |
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- 判定「爆破」前，先核对来源是否为公司 / 合法运维跳板、是否被误报；
- 异常登录（failed→success）优先级最高，优先排查该来源后续行为；
- sudo 事件应结合执行者身份、命令内容、时间与业务合理性能否解释。