火绒高级威胁防护规则

显示全部楼层 · 发表于 2021-6-30 19:40:45

本帖最后由 lvhaoran123 于 2021-6-30 19:45 编辑

------------------------------------------------------------------------------------------------------------------------------------------
Rule: [结束]勒索行为防护.B.00
Action: [Create]
Target: C:\ProgramData\VAwm1J75o9gWc8.txt
Result: Permitted

Process ID: 3608
Process: C:\Users\Reddit\AppData\Roaming\Tencent\QQ\STemp\SetupEx0\QQSetupEx.exe
Process Command line: "C:\Users\Reddit\AppData\Roaming\Tencent\QQ\STemp\SetupEx0\QQSetupEx.exe" 14692 nosilent
Parent Process ID: 11620
Parent: D:\360Downloads\Software\360SoftMgrSafeRun\腾讯QQ_9.4.9.27847.exe
Parent process Command line: "D:\360Downloads\Software\360SoftMgrSafeRun\腾讯QQ_9.4.9.27847.exe"
-------------------------------------------------------------------------------------------------------------------------------------------
Rule: [结束]木马行为防护.A.00
Action: [Execute]
Target: C:\Users\Reddit\AppData\Roaming\2960718.exe
Result: Permitted

Process ID: 11248
Process: C:\Program Files (x86)\360\360CleanMaster\Uninstall.exe
Process Command line: "C:\Program Files (x86)\360\360CleanMaster\Uninstall.exe"
Parent Process ID: 11568
Parent: C:\Program Files (x86)\360\360SoftMgr\SoftMgr\SoftMgr.exe
Parent process Command line: "C:\Program Files (x86)\360\360SoftMgr\SoftMgr\SoftMgr.exe" "C:\Program Files (x86)\360\360SoftMgr\SoftMgr\SoftMgr.exe" /elevated

显示全部楼层 · 发表于 2021-6-30 19:45:19

@Jerry.Lin

显示全部楼层 · 发表于 2021-6-30 21:55:47

支持一下

显示全部楼层 · 发表于 2021-7-2 19:07:17

Rule: [结束]木马行为防护.C.00
Action: [Write]
Target: HKEY_USERS\S-1-5-21-3018402420-920894301-585091951-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ctfmon
Result: Permitted

Process ID: 16000
Process: C:\Users\Reddit\AppData\Local\Temp\sogou_pinyin_10.5.0.4737.exe
Process Command line: "C:\Users\Reddit\AppData\Local\Temp\sogou_pinyin_10.5.0.4737.exe" /S /runbysrv
Parent Process ID: 12584
Parent: C:\Program Files (x86)\SogouInput\SogouExe\SogouSvc.exe
Parent process Command line: "C:\Program Files (x86)\SogouInput\SogouExe\SogouSvc.exe"

显示全部楼层 · 发表于 2021-7-2 19:07:38

@Jerry.Lin

显示全部楼层 · 发表于 2021-7-2 19:25:18

lvhaoran123 发表于 2021-6-30 05:40
---------------------------------------------------------------------------------------------------- ...

来了

Rule: [结束]勒索行为防护.B.00
Action: [Create]
Target: C:\ProgramData\VAwm1J75o9gWc8.txt
Result: Permitted

允许即可

Rule: [结束]木马行为防护.A.00
Action: [Execute]
Target: C:\Users\Reddit\AppData\Roaming\2960718.exe
Result: Permitted

目测是广告相关,可以阻止

Rule: [结束]木马行为防护.C.00
Action: [Write]
Target: HKEY_USERS\S-1-5-21-3018402420-920894301-585091951-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ctfmon
Result: Permitted

更新时碰到的,可以允许

显示全部楼层 · 发表于 2021-7-7 11:38:06

帖子最后编辑日期是21年6月23日，规则下载的网盘最新规则只有1月份的，没见6月份的。

显示全部楼层 · 发表于 2021-7-9 09:52:48

感谢楼主辛苦制作，无私分享

显示全部楼层 · 发表于 2021-7-17 02:17:03

谢谢分享！

显示全部楼层 · 发表于 2021-7-19 17:28:07

支持群主牛皮

[分享] 火绒高级威胁防护规则