Avira Sentry技术的报毒名百科大全，原来Sentry 有这么多报法！

驭龙

趁着我还没有因为Avira恐怖的写硬盘问题，卸载Avira，我先跟大家分享一下Avira Sentry技术特有的报毒名，虽然说Sentry是ML技术的打分类行为分析技术，但Sentry的本地行为报毒名分类还是不少的，接近有二百个类型的行为报毒名，首先定位到Sentry的本地特征库位置。
C:\ProgramData\Avira\Endpoint Protection SDK\common\sentry_common\Definitions\Definitions2\
该特征库文件夹的大小，现在是17MB大小，198个文件。


文件格式分为四个类型，分别是：ML库的PB格式，ML库配置的CFG格式，行为报毒名POL格式（也可以说是行为特征名），非固定报毒名的LDA格式。

值得注意的是，虽然POL是行为特征名，但是Sentry并不一定单独显示此名称，Sentry还会结合其他内容如云库和其他数据，显示混合类型的完整报毒名。

所以Avira Sentry的报毒名不仅仅只有本地这些行为特征的报毒名哟
感谢tihs饭友的测试截图（行为特征报毒名出现为l2_MemAllocProcess.pol）


Sentry本地机器学习的核心库，就是这几个PB格式的文件：


其中POL格式的文件名就是Sentry报法的行为特征名称，前面开头为：Drop.加上POL文件名*（以及其他数据内容），就是Sentry的报毒名了，下面分享一下POL格式文件名（这种行为特征名的报法应该算是本地行为分析了吧）的全部行为特征名称：
蓝色应该不是报毒名，绿色为非固定报毒名，应该是跟云库和特征库报法联动。

523E7825BA5AF578ECBAD3ABE266FBD3 cfg_ml.pol
B2CD6D61BC44D5204D17FE5DE0AA9611 l0_InstallerInfo.pol
F3A9FB6DA50F9842C87313A41C438B4B l0_White.pol
17DF866747BE8213D1BD68EA613C340A l1_AMSIAlert.pol
F3BA054F15ECE60BA6865EA0A113718C l1_AppAssoc.pol
9C650131E0505550F34FD9656AA82107 l1_BrowserHelperObj.pol
136C8DC8E96C2C0506763585F0C1AA86 l1_ChildAlert.pol
5A3DE7AF5D6D9259C989175FDD3F7686 l1_ControlSet.pol
6F705C867F269D5408DF4FA918662D74 l1_CryptoMiner.pol
8E830CB4D8A2D3DC9F71A9884750E0E8 l1_DefaultDebugger.pol
570D5C5E8CBA93D8118BA3846E1E2CFD l1_DisableRegTools.pol
788390E41B581755E5AA13715A2AA246 l1_DisableTaskMgr.pol
F2D92BE8F3A5B6CB2BD4A99CE6AD73CD l1_Emotet.pol
FC1424E2766CD0DED0A269E5C0B15E39 l1_ExeDrop.pol
AC20E885426BD05F2A6019ABDD97143B l1_ExplorerPolicy.pol
9702BBBBF9454D96FB5EB374E51CFAE3 l1_EyeScore.pol
599DE1A2399F0118D0558D2A76DFEA4C l1_FakeSig.pol
F1ED698E87EDB1AE3032FD76FBCB98D5 l1_FakeWinProg.pol
12D5E14168CDB08146DA983302EFC173 l1_Firewall.pol
28EA9727B327A62CD70A2A4D9092FE86 l1_FirewallChange.pol
F7FEBBA6B3506A6888BDCC167E189AAB l1_Hidden.pol
C3E33F1A7616C9C148EC9F9ADF763AC1 l1_IExplorer.pol
E31DEF6065EE8AE4AE6FCF89E2825A5F l1_Inject.pol
5A9F216921DEAD754941B62E08ACC284 l1_LocalApp.pol
F9954BCA8CFBBE563C6D99C4A2EDB442 l1_MiscFlags.pol
513B7DE6186AB867A3E5D64F19A36443 l1_MLD.pol
67427A9B017F9E4D3E474B48E0CB5898 l1_MsHta.pol
94A4C197175846971394F87A74865A37 l1_NoFolderOptions.pol
524D12BCD785AD12D159B1137C4D11F6 l1_OnAccessAlert.pol
0DC0FB1F0507C721978B135CF54BADF0 l1_OnFileScanAlert.pol
EA4F71E089A66DC5736679FC7A63B430 l1_OnSafeBrowsing.pol
C219F1B71C84D2A166D6318D7A39B4A2 l1_Progdata.pol
D99A961264664DF512EA4B7A3408DA3D l1_PsDownload.pol
63A7814C855F81F31AD4963875FBF4AE l1_Recycle.pol
D190A6721FC34603C7FF74FBCB75C8A4 l1_RegAppInit.pol
CC5A0ECD356F7F3986C5297267775F32 l1_RegRunServices.pol
D80E7972C580EC59568CC7D9BDA88EF1 l1_RegShellRun.pol
7DE8F30E7CFADC6F716C79BBBEED8818 l1_RegStartup.pol
59B312DCE5B5278B83C0731EACB43E39 l1_RegStartupFolders.pol
246B80591267D93FA95D5B94C61365E0 l1_RegSysCert.pol
BAB6CF91196462B9E73FDBB782FEBEB7 l1_RegSystemCertificates.pol
8AAC4D1E9A3723F450CE8A3616D85B14 l1_RegWinFirewall.pol
018B9CC6B185742366612717317AB7D3 l1_RegWinLogon.pol
C89FA59BB24A88A676F94E61C1FB79A6 l1_Roaming.pol
4C5D65F60A098A746FA39DF19A0FC860 l1_RunBrowser.pol
9F797C2D4362B3C5E2EBD0633D384634 l1_SharedTaskSched.pol
DD49C664D1AA0857F00658441A9480CE l1_ShellExecuteHooks.pol
0203E05CDE8DE12BC763B337AD78F6D6 l1_ShellHijack.pol
E5CB514EA421B90D9482133B146DA557 l1_Startup.pol
9D32AF05A84B83A7805AE20F1B3B669F l1_SysPolicy.pol
AB68A02CE5D2E97AF773B657B7D104B9 l1_UserProfile.pol
BBF87956F9C79F1CC1A7FD4173CE7D6B l1_VbsScript.pol
884D5782DF0E666F97A3ABFFEE1B7082 l1_VSSDelete.pol
50D6F765911BDD600D24F12552347B17 l1_WinDefend.pol
9AD70EC9012949BE65D8BE515A5BEFDA l1_WinDir.pol
BC581BBD9BA6D8963C2B16704FE8624F l2_AMSIAlert.pol
CF1493A8D9B8FAD6FF5C6C9F90920D6F l2_ChildAlert.pol
09F28BEEFEF0658C3A360AD2C90E3D93 l2_ControlSetSelfCopy.pol
1157999D6B0D58F8B61B445A1C78054B l2_ControlSetSelfDelete.pol
154D3D4B2D9773CDB95DEBC9C2A195AC l2_ControlSetSelfRename.pol
1900A4127AC5F71832DFA9B59E6442D3 l2_FakeExeDrop.pol
095B25AFCECBEA08DCA446B5DC43624D l2_FakePro不可说Change.pol
9287A4930494889A4549A7190A320005 l2_FakeProgHidden.pol
79CE68B0CF79B92D7308AEBFAEBCC916 l2_FakeProgRegStartup.pol
23319D318A5D940AA906467D792E86FE l2_FakeProgSelfCopy.pol
0897443E9898EA378820269A70948632 l2_FakeProgSelfRename.pol
7836F3960E52CD26D4276B920187B24F l2_FakeProgSelfRun.pol
CBAA3DBAEAC5F1B134E95E53E23C9F2E l2_FakeProgWinDir.pol
4E23E72EB2307EF8B0036133687F583E l2_FileType.pol
573C8EF3CB0B1D59DF7A42741604D65F l2_HiddenRecycle.pol
E9BB3200E71337B813A6891645E71308 l2_Invertor.pol
6C0C881CC0399E41B73333FCBF36CB84 l2_LocalAppSelfCopy.pol
27579107C23E66CB57F61007952D1B95 l2_LocalAppSelfRename.pol
F9133683D066D06EF5E3C9B33E8E1378 l2_LocalAppSelfRun.pol
6686F4855769534D4E1D3F94BDCE5FEC l2_MemAllocApps.pol
D45FFFFFAFAD6909DD427708BE044DAA l2_MemAllocChrome.pol
0E4F54852DA95C8B605F228911068AEF l2_MemAllocEdge.pol
5B821AB93B16339FC03FF71C52CC7A4F l2_MemAllocFirefox.pol
DCFDB4C94389CBAB5EB0BCE1000654CF l2_MemAllocIE.pol
F312C6B59600CC3C37E70929015AA918 l2_MemAllocNet.pol
6E5E7740C946639604B7608CBF46D45F l2_MemAllocOpera.pol
F1C5508E2A080AE616707826A1C58646 l2_MemAllocProcess.pol
624EAA03317959731CA688E0134D5701 l2_MemAllocSelf.pol
C7D39A61239803C42EF465886DF17812 l2_MemAllocWow.pol
DCC13218E99A68D4E675FE2427647A94 l2_MemChangeNet.pol
86CAD97D54B3EE23217EED05336BF733 l2_MemChangeSelf.pol
379CD81746ABCB667DC07DD094E2D6F3 l2_MemChangeWow.pol
B604EC501860D983A1D78AD8CF61199D l2_MemContextIE.pol
FE2280B33A458972E08FEC56E3EAFD65 l2_MemContextNet.pol
DA4B7D173A420EB3FA792552922DC916 l2_MemContextProcess.pol
3973E2FA6E94A8217736AA1BF074D6EB l2_MemContextSelf.pol
1C0C693EC3598A2700074EDCCD72C1C8 l2_MemMapNet.pol
F15CFE9EB47A457132038E0BE63A0FBA l2_MemMapProcess.pol
946331103A0EB8995C480561C0DA9AC2 l2_MemMapSelf.pol
C3F397B7F597980FBB7BFFB114D45FD3 l2_MemMapWow.pol
D7719027A20015E3C98D9607691090A9 l2_MemTaskIE.pol
B06D87089A671E04E028DACA0265D46F l2_MemTaskProcess.pol
79CF2DFEA3CF1D9EB9B5A18267B7E066 l2_Misc.pol
0FB164DE1A532947E66F7FF5F368B8F9 l2_ML.pol
BC6253C001D6CF84E38F05E47E65A3BA l2_MLD.pol
F17E8B5C7E42A97459F4872184D9DA5A l2_MLDCpy.pol
8D8E148BD70E9537AB9F04DEB626AB67 l2_MLDCrypto.pol
473FB0F7953AEEAF16F2388A829C70F8 l2_MLDDel.pol
812D6DF3C93785FDF04BECC82BA89C4B l2_MsHtaAssoc.pol
5A0B96535FD5EFA99D49AAF4AE4FB8A1 l2_OnAccessAlert.pol
8D00CC50178A013AC9BEA5C8DBF49051 l2_OnFileScanAlert.pol
9197203D9BCF8833F4B7D82505C43C09 l2_OnFlare11Scan.pol
B1F123B3E153C8F9B132F87381F0B983 l2_ProgdataExplorerPolicy.pol
79781607DF436B7BAB7938894B4EB75E l2_ProgdataRegStartup.pol
1DC83264025C168C7814A1751ADAB7BB l2_ProgdataSelfCopy.pol
332A65A6FE16BC0512883AFC37AFE1FF l2_ProgdataSelfRename.pol
5361055C3F104F40C7C68937DFA7B0B7 l2_ProgdataSelfRun.pol
1844E675B888A42FA82A989345E6D6AB l2_ProgdataVSSDelete.pol
E173E785F35D786932DD5B77BCF7B78C l2_PsDownloadSelfRun.pol
778927AD8BD86ED7F28B3D5383562DAC l2_RecycleSelfRun.pol
1871366D34480BA5016ABD9B2EAAD39E l2_RegAppInit.pol
D6D3F46F0C65338CC19B84BC9F91FA3D l2_RegRunServices.pol
38B5C8854C0FE2456FA6BB17BAC3B12B l2_RegStartupCryptoMiner.pol
53B4584109430E6123797941DB72A357 l2_RegStartupExplorer.pol
A8DCD7700FD6E4D5F8B9279582436AF3 l2_RegStartupFolders.pol
0EDFB66EDE55B0F836778D61E28CC140 l2_RegStartupFwChange.pol
07A0DCB1DF6C6745DB946CE83D39B2E6 l2_RegStartupHidden.pol
C6739678EFC86AB8BCA3F3D26BEE16C6 l2_RegStartupLocalApp.pol
9B7F09FE97C7CD1F9A9ABA4749C32EFB l2_RegStartupRecycle.pol
3ABEA8043606C6070ABF246FD63E959B l2_RegStartupRoaming.pol
5AF2990A45B1A55E8F0C4F27A195F551 l2_RegStartupSelfCopy.pol
9770A7BE9FA12F60769076E0DB40D787 l2_RegStartupSelfDelete.pol
C1B10838103A79F4C4C9DBD031A4EC99 l2_RegStartupSelfRename.pol
B79F716BB911B3F47AD79550C830AEB5 l2_RegStartupSysPolicy.pol
F774FA38F996A34CCF02B96C27586290 l2_RegStartupUserProfile.pol
F0AC9F1D6A801748233ACF380B1F04AB l2_RegStartupWin.pol
03353F0481AAD1B044498CC795D7114A l2_RegStartupWinLogon.pol
798A562444F3B8C3DADE8E61BDC37E23 l2_RegWinLogonHidden.pol
CAE70911F085D025F4A78D0167FA75BD l2_RoamingControlSet.pol
A22AEF80857EE7F13630AAFFA614A16E l2_Roamin不可说Change.pol
1AB6767B5EB0152BE7C4A15AF93FFB6F l2_RoamingInject.pol
325EE245CD2EEFDA73497893CE3410EA l2_RoamingSelfCopy.pol
C720CC6F0B76C0068DCADB6A936CD6D7 l2_RoamingSelfRename.pol
B7153A110984D29A592977F0C65A9926 l2_RoamingSelfRun.pol
A8F897BF589E4F937175890643B6516E l2_ScoreControlSet.pol
AE9838FB57AE2B7A513C105A58E4B31B l2_ScoreExeDrop.pol
85160F25848ADFDCF0A3479592123C42 l2_ScoreExeDropKiller.pol
ECD62E672333994BC0FC4739029F6962 l2_ScoreExeDropMsHta.pol
65DC5F9F684D4E731D496D781471A51F l2_ScoreExeDropSchd.pol
A3C192A818223B84C933D6C19DA0F494 l2_ScoreExeDropStartup.pol
399BE2D9305BAE059F599065FEC8E5B8 l2_ScoreExeDropSysCert.pol
3A50E731900D1CFE0D10C9E20FC65A74 l2_ScoreExplorerKiller.pol
7FB6E5964D319497F86A88ABADD94FC8 l2_ScoreFirewallChange.pol
65D4B29BFF0F1E83ED8A46B81FE4F86F l2_ScoreHidden.pol
2653975D7C290F094993141949772E29 l2_ScoreInject.pol
699254D44AC51FD19EB558A529AD0BCD l2_ScoreKiller.pol
09E983B5C55DA64F3E8FD59713D180E1 l2_ScoreRegStartup.pol
E7B6AFAD3A1C2950AF8FC0AD809626A6 l2_ScoreRegWinFirewall.pol
C45C02BBEF537DE267B485DBD51F80D4 l2_ScoreSelfDelete.pol
7AEDE7288436FA4F0A2FD72D35AEB34B l2_Startup.pol
C928CCA895D52DE8A8DE6860957EE94B l2_SvcHostInject.pol
A696615B86E516B65FDBA10B7A03BC2A l2_SvcHostLeech.pol
AE35234771B60C53D371065A660D411B l2_SysPolicySelfCopy.pol
953FAC655F0A88D0DC537C20CD8DD6B4 l2_SysPolicySelfDelete.pol
A301640BE10AA927346108613ABEBA6D l2_SysPolicySelfRename.pol
B7BFF93D662867D77CB1BC00634A48C2 l2_UserProfileSelfRun.pol
11481875CFFB215A096E891674CD1B0D l2_VbsScriptAssoc.pol
1625B99F942222117EBB735637119F7C l2_WinDirBHO.pol
A82D8D950626F0804605C46BCBAC7CA3 l2_WinDirControlSet.pol
5B5FB09C6BA30EF9B69B6E4ABED879E8 l2_WinDirCryptoMiner.pol
A1FEDF484D05516B5A94B80FDE6FBE02 l2_WinDirExplorerPolicy.pol
27810BF59EFFAC6EFE1CF9FBADDAABCE l2_WinDirFwChange.pol
937958945D40407BE442474D596C0924 l2_WinDirHidden.pol
8296A3FD69F2BC492051044D1D1F96F8 l2_WinDirNFO.pol
AB73313BD494E0CA085F412D27ED1F94 l2_WinDirRegWinLogon.pol
00443F6217AC725E3DE7E5991A5C23B0 l2_WinDirSelfDelete.pol
050CDF7AB0CDC969E6A76BE803119E44 l2_WinDirShellHook.pol
311E5A4CC4251C370DEC87BA396E8B87 l2_WinLogonSelfCopy.pol
F40A77A67533DF248F773C24DEB418A7 l2_WinLogonSelfRename.pol
2DBD5B620CC4B6E7E5939B6B8F4000CF l2_WinSelfCopy.pol
DD00D94199EA7D5312E1FA5B1E4114E4 l2_WinSelfRename.pol
D45EA2C339921F51EB15EE537CC01EF5 l2_WinSelfRun.pol
CD7A0F845B6136BAC980EC38E444AF45 l3_GameDetection.pol
D9FEB25505BF3C1BF4B5325488EFB32A l3_InstallerDetectionCU.pol
AE37F0FA1F50A50A56DCEED328BE037C l3_InstallerDetectionCUReqElev.pol
365E3353EE0BE5AFDBFA1D675A68E48B l3_InstallerDetectionLM.pol
F0CCC4FD7A84C2D05F05CDB0054F4BC5 l3_InstallerDetectionLMReqElev.pol
16EF39B482551BE1E9C54A3E54F5E8E7 l3_InstallerDetectionLMWow64.pol
B38669A275551AD2A3C0657FBF0F72D4 l3_InstallerDetectionLMWow64ReqElev.pol
B03622FC7B2E49970AAE9A6E447AE0DB l3_VerifiedInstaller.pol
3BB642F329D5892884C04CE00F2C035A l3_VerifiedUnInstaller.pol
81C285E86F284A507C93FB2E32F58C9E lm_sha_pe.cfg
DCD31AD88BFE53B4E1962731254BF39B lm_sha_pe.pb
FDE7E448AC9C65EA1951D864A84A807C lmd_sha_pe.cfg
AB3D5712C353CD99B3D198FF0C048F09 lmd_sha_pe.pb
17D2579361C52FCB3F37073C4964134D l0_FilterSuspiciousDlls.lda
8E45B913FE1437989F150A0C0AE057A0 l0_ProcessNameClassify.lda
ADCC5538B2ADF88FFB888E980AC6087C l2_JSPSExeDropper.lda
0AF31AE2BF813C7713E247CF4A7FBD66 l3_Detection.lda

这是一个通过LDA与云库联动的Sentry报法，感谢提供“断簪”的截图


Sentry的进程sentry eye会给可疑的文件进行评估打分，到达某个MLD机器学习检测的得分阈值，sentry就会出手了。
我实机就不测双击结果了，我这里只有一点点Sentry对系统文件的评估打分日志：

2024/09/06 15:16:10.692 | [MLD] Evaluated [Path = c:\windows\system32\rundll32.exe ][PUNQ = 1997159809704 ][Score = 0.9126 ] in 0(ms)
2024/09/06 15:17:10.709 | [MLD] Evaluated [Path = c:\windows\system32\rundll32.exe ][PUNQ = 1997159809704 ][Score = 0.9126 ] in 0(ms)
2024/09/06 15:18:13.419 | [MLD] Evaluated [Path = c:\windows\system32\rundll32.exe ][PUNQ = 2100239020632 ][Score = 0.9965 ] in 0(ms)
2024/09/06 15:19:13.432 | [MLD] Evaluated [Path = c:\windows\system32\rundll32.exe ][PUNQ = 2100239020632 ][Score = 0.9965 ] in 0(ms)
2024/09/06 15:20:13.452 | [MLD] Evaluated [Path = c:\windows\system32\rundll32.exe ][PUNQ = 2100239020632 ][Score = 0.9965 ] in 0(ms)
2024/09/06 15:30:27.393 | [MLD] Evaluated [Path = c:\windows\system32\rundll32.exe ][PUNQ = 3006477111716 ][Score = 0.9126 ] in 0(ms)
2024/09/06 15:31:27.390 | [MLD] Evaluated [Path = c:\windows\system32\rundll32.exe ][PUNQ = 3006477111716 ][Score = 0.9126 ] in 0(ms)
2024/09/06 15:32:27.407 | [MLD] Evaluated [Path = c:\windows\system32\rundll32.exe ][PUNQ = 3006477111716 ][Score = 0.9126 ] in 0(ms)
2024/09/06 15:59:57.246 | [MLD] Evaluated [Path = c:\windows\system32\rundll32.exe ][PUNQ = 3350074507364 ][Score = 0.9999 ] in 0(ms)
2024/09/06 16:00:57.258 | [MLD] Evaluated [Path = c:\windows\system32\rundll32.exe ][PUNQ = 3350074507364 ][Score = 0.9999 ] in 0(ms)
2024/09/06 16:01:57.276 | [MLD] Evaluated [Path = c:\windows\system32\rundll32.exe ][PUNQ = 3350074507364 ][Score = 0.9999 ] in 0(ms)

可惜我老爷机安装Avira无法开启Sentry的进程sentry eye，不然就进一步测试了，今天就到这里吧，以后有机会，虚拟机中我在进一步测试Sentry的更多内容吧。

驭龙

我尽力了，我在新电脑上安装沙盒，结果，没有几个样本能逃过SAC的封杀，所以我不测Sentry了。

一楼更新了其他饭友的测试截图，确实是会出现本地行为特征的报毒名报法。

ytysh

小红伞免费版有这个进程吗？

驭龙

ytysh 发表于 2024-9-6 21:01
小红伞免费版有这个进程吗？

有的，如果不是遇到BUG或者不支持的设备，基本上都有Sentry功能

Jirehlov1234

打分居然还有日志的吗。这样岂不是方便调试降分了。

驭龙

Jirehlov1234 发表于 2024-9-6 21:41
打分居然还有日志的吗。这样岂不是方便调试降分了。

你看我发的日志，好像确实是本地打分，可惜我没环境双击，不然会有更多信息，无奈

pal家族

快卸载吧 二流杀软不配龙大用

驭龙

pal家族 发表于 2024-9-6 22:41
快卸载吧 二流杀软不配龙大用

说实话，真不弱了，只不过比不上卡巴和BD系

pal家族

驭龙 发表于 2024-9-6 23:04
说实话，真不弱了，只不过比不上卡巴和BD系

体验不行 那个UI是在难受
交给国内大学生用electron都能做的更好

蒙特卡洛

现在红伞卡的已经像原来的卡巴斯基了

驭龙

pal家族 发表于 2024-9-6 23:11
体验不行 那个UI是在难受
交给国内大学生用electron都能做的更好

用户层的交互界面确实是差，但架构和内核并不差，所以我再坚持坚持