用脚本检测并终止可疑进程

wen 实用脚本 2026-07-28 2

本文目录导读：

用脚本检测并终止可疑进程

Linux Bash 脚本
Windows PowerShell 脚本
Python 跨平台脚本
使用说明
注意事项

我将为您提供几种检测和终止可疑进程的脚本方案，这里需要说明，脚本只能基于预设规则进行检测，真正的"可疑"判断需要结合安全分析。

Linux Bash 脚本

#!/bin/bash
# 可疑进程检测脚本
# 功能：检测CPU/内存异常、可疑命令、隐藏进程等
# 配置
CPU_THRESHOLD=80    # CPU使用率阈值(%)
MEM_THRESHOLD=80    # 内存使用率阈值(%)
LOG_FILE="/var/log/suspicious_process.log"
SUSPICIOUS_NAMES=("nc" "netcat" "ncat" "cryptominer" "xmr" "minerd" "ccminer" "python3 -m http.server" "perl -e" "bash -i")
# 日志函数
log() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE"
}
# 检查CPU/内存异常
check_resource_abuse() {
    log "检查资源异常进程..."
    ps aux --sort=-%cpu | awk -v cpu=$CPU_THRESHOLD -v mem=$MEM_THRESHOLD '
    NR>1 {
        if($3 > cpu || $4 > mem) {
            print "资源异常: PID="$2 " CPU="$3"% MEM="$4"% CMD="$11
        }
    }'
}
# 检查可疑进程名
check_suspicious_names() {
    log "检查可疑进程名..."
    for name in "${SUSPICIOUS_NAMES[@]}"; do
        pgrep -f -l "$name" 2>/dev/null | while read pid cmd; do
            echo "可疑进程: PID=$pid CMD=$cmd"
            log "发现可疑进程: $cmd"
        done
    done
}
# 检查隐藏进程（修改了进程名的进程）
check_hidden_process() {
    log "检查隐藏进程..."
    # 比较/proc和ps输出
    ps_pids=$(ps aux | awk '{print $2}' | sort -u)
    proc_pids=$(ls /proc | grep -E '^[0-9]+$' | sort -u)
    hidden_pids=$(comm -13 <(echo "$ps_pids") <(echo "$proc_pids"))
    if [ -n "$hidden_pids" ]; then
        for pid in $hidden_pids; do
            if [ -d "/proc/$pid" ]; then
                cmd=$(cat /proc/$pid/cmdline 2>/dev/null | tr '\0' ' ')
                log "发现隐藏进程: PID=$pid CMD=$cmd"
            fi
        done
    fi
}
# 检查网络连接异常
check_network_anomalies() {
    log "检查异常网络连接..."
    # 检测反向shell
    ss -tunp | grep -E '(ESTAB|TIME_WAIT)' | while read line; do
        # 检查常见后门端口
        ports=(4444 5555 6666 7777 8888 9999 1234 2345 3456 4567 5678 6789)
        for port in "${ports[@]}"; do
            if echo "$line" | grep -q ":$port"; then
                log "发现反向shell端口: $line"
            fi
        done
    done
}
# 检查同形异义字攻击(homoglyph attack)
check_homoglyph() {
    log "检查伪装进程..."
    ps aux | awk '{print $11}' | while read cmd; do
        # 检查是否包含非ASCII字符
        if echo "$cmd" | grep -qP '[^\x00-\x7F]'; then
            log "发现可能伪装的进程: $cmd"
        fi
    done
}
# 终止可疑进程
terminate_process() {
    local pid=$1
    local reason=$2
    log "终止进程 PID=$pid 原因: $reason"
    # 先尝试正常终止
    kill $pid 2>/dev/null
    sleep 2
    # 如果还在运行，强制终止
    if kill -0 $pid 2>/dev/null; then
        kill -9 $pid 2>/dev/null
        log "强制终止进程 PID=$pid"
    fi
}
# 主程序
main() {
    log "=== 可疑进程检测开始 ==="
    # 检查各类可疑进程
    check_resource_abuse
    check_suspicious_names
    check_hidden_process
    check_network_anomalies
    check_homoglyph
    log "=== 检测完成 ==="
}
# 运行
main

Windows PowerShell 脚本

# 可疑进程检测脚本 (Windows)
# 保存为 .ps1 文件运行
param(
    [switch]$Terminate,
    [string]$LogPath = "C:\Logs\suspicious_process.log"
)
# 配置
$ThresholdCPU = 80
$ThresholdMemory = 80
$SuspiciousNames = @("nc.exe", "netcat.exe", "ncat.exe", "minerd.exe", "ccminer.exe", "python.exe", "perl.exe")
$SuspiciousPorts = @(4444, 5555, 6666, 7777, 8888, 9999, 1234, 2345, 3456)
# 日志函数
function Write-Log {
    param($Message)
    $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    $logMessage = "[$timestamp] $Message"
    Write-Host $logMessage
    Add-Content -Path $LogPath -Value $logMessage
}
# 检查资源异常
function Check-ResourceAbuse {
    Write-Log "检查资源异常进程..."
    $processes = Get-Process | Where-Object {
        ($_.CPU -gt $ThresholdCPU -and $_.CPU -ne $null) -or
        ($_.WorkingSet64/1MB -gt $ThresholdMemory)
    }
    foreach ($proc in $processes) {
        $cpuUsage = [math]::Round($proc.CPU, 2)
        $memUsage = [math]::Round($proc.WorkingSet64/1MB, 2)
        Write-Log "资源异常: PID=$($proc.Id) CPU=${cpuUsage}% MEM=${memUsage}MB $($proc.ProcessName)"
    }
}
# 检查可疑进程名
function Check-SuspiciousNames {
    Write-Log "检查可疑进程名..."
    foreach ($name in $SuspiciousNames) {
        $processes = Get-Process -Name $name.Replace(".exe", "") -ErrorAction SilentlyContinue
        foreach ($proc in $processes) {
            Write-Log "发现可疑进程: PID=$($proc.Id) Name=$($proc.ProcessName)"
            if ($Terminate) {
                try {
                    Stop-Process -Id $proc.Id -Force
                    Write-Log "已终止进程 PID=$($proc.Id)"
                } catch {
                    Write-Log "无法终止进程 PID=$($proc.Id): $_"
                }
            }
        }
    }
}
# 检查网络连接
function Check-NetworkConnections {
    Write-Log "检查网络连接..."
    $connections = Get-NetTCPConnection | Where-Object {
        $SuspiciousPorts -contains $_.RemotePort
    }
    foreach ($conn in $connections) {
        $process = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
        if ($process) {
            Write-Log "可疑连接: PID=$($process.Id) Process=$($process.ProcessName) Remote=$($conn.RemoteAddress):$($conn.RemotePort)"
        }
    }
}
# 检查隐藏进程
function Check-HiddenProcesses {
    Write-Log "检查隐藏进程..."
    try {
        $wmiProcesses = Get-WmiObject Win32_Process
        $apiProcesses = [System.Diagnostics.Process]::GetProcesses()
        $hiddenPids = $apiProcesses | Where-Object { 
            $wmiProcesses.ProcessId -notcontains $_.Id 
        }
        foreach ($proc in $hiddenPids) {
            Write-Log "可能隐藏的进程: PID=$($proc.Id) Name=$($proc.ProcessName)"
        }
    } catch {
        Write-Log "检查隐藏进程时出错: $_"
    }
}
# 主程序
function Main {
    Write-Log "=== 可疑进程检测开始 ==="
    # 确保日志目录存在
    $logDir = Split-Path $LogPath -Parent
    if (-not (Test-Path $logDir)) {
        New-Item -ItemType Directory -Path $logDir -Force
    }
    # 执行检测
    Check-ResourceAbuse
    Check-SuspiciousNames
    Check-NetworkConnections
    Check-HiddenProcesses
    Write-Log "=== 检测完成 ==="
}
# 运行
Main

Python 跨平台脚本

#!/usr/bin/env python3
"""
进程监控和可疑进程检测脚本
支持Linux和Windows
"""
import os
import sys
import signal
import psutil
import logging
import subprocess
from datetime import datetime
# 配置
CPU_THRESHOLD = 80.0
MEM_THRESHOLD = 80.0
SUSPICIOUS_NAMES = ['nc', 'netcat', 'ncat', 'minerd', 'ccminer', 'xmr']
SUSPICIOUS_PORTS = [4444, 5555, 6666, 7777, 8888, 9999, 1234, 2345, 3456]
# 日志配置
logging.basicConfig(
    level=logging.INFO,
    format='%(asctime)s - %(levelname)s - %(message)s',
    handlers=[
        logging.FileHandler('/var/log/suspicious_process.log' if os.name == 'posix' else 'C:\\Logs\\suspicious_process.log'),
        logging.StreamHandler()
    ]
)
def check_resource_abuse():
    """检查资源异常"""
    logging.info("检查资源异常进程...")
    for proc in psutil.process_iter(['pid', 'name', 'cpu_percent', 'memory_percent']):
        try:
            cpu = proc.info['cpu_percent']
            mem = proc.info['memory_percent']
            if cpu and cpu > CPU_THRESHOLD:
                logging.warning(f"CPU异常: PID={proc.info['pid']} CPU={cpu}% {proc.info['name']}")
            if mem and mem > MEM_THRESHOLD:
                logging.warning(f"内存异常: PID={proc.info['pid']} MEM={mem}% {proc.info['name']}")
        except (psutil.NoSuchProcess, psutil.AccessDenied):
            continue
def check_suspicious_names():
    """检查可疑进程名"""
    logging.info("检查可疑进程名...")
    for proc in psutil.process_iter(['pid', 'name', 'exe', 'cmdline']):
        try:
            name = proc.info['name']
            cmdline = ' '.join(proc.info['cmdline']) if proc.info['cmdline'] else ''
            for suspicious in SUSPICIOUS_NAMES:
                if suspicious.lower() in name.lower() or suspicious.lower() in cmdline.lower():
                    logging.warning(f"可疑进程: PID={proc.info['pid']} Name={name} CMD={cmdline}")
        except (psutil.NoSuchProcess, psutil.AccessDenied):
            continue
def check_network_connections():
    """检查网络连接"""
    logging.info("检查网络连接...")
    for conn in psutil.net_connections():
        try:
            if conn.status == 'ESTABLISHED' and conn.raddr:
                if conn.raddr.port in SUSPICIOUS_PORTS:
                    proc = psutil.Process(conn.pid)
                    logging.warning(f"可疑连接: PID={conn.pid} Process={proc.name()} "
                                  f"Remote={conn.raddr.ip}:{conn.raddr.port}")
        except (psutil.NoSuchProcess, psutil.AccessDenied):
            continue
def check_hidden_processes():
    """检查隐藏进程"""
    logging.info("检查隐藏进程...")
    # 获取所有进程PID
    pids = set(psutil.pids())
    # 在Linux上检查/proc
    if os.name == 'posix':
        try:
            proc_pids = set()
            for pid_dir in os.listdir('/proc'):
                if pid_dir.isdigit():
                    proc_pids.add(int(pid_dir))
            hidden = proc_pids - pids
            if hidden:
                logging.warning(f"发现隐藏进程: {hidden}")
        except PermissionError:
            pass
def terminate_process(pid, force=False):
    """终止进程"""
    try:
        proc = psutil.Process(pid)
        proc.terminate()
        if force:
            proc.kill()
        logging.info(f"已终止进程 PID={pid}")
    except psutil.NoSuchProcess:
        logging.warning(f"进程 PID={pid} 不存在")
    except psutil.AccessDenied:
        logging.error(f"无权限终止进程 PID={pid}")
def main():
    """主函数"""
    logging.info("=== 可疑进程检测开始 ===")
    check_resource_abuse()
    check_suspicious_names()
    check_network_connections()
    check_hidden_processes()
    logging.info("=== 检测完成 ===")
if __name__ == "__main__":
    main()

使用说明

Linux:

# 赋予执行权限
chmod +x suspicious_process.sh
# 运行
sudo ./suspicious_process.sh
# 定期运行(添加到crontab)
*/5 * * * * /path/to/suspicious_process.sh

Windows:

# 以管理员身份运行
powershell -ExecutionPolicy Bypass -File suspicious_process.ps1
# 自动终止
powershell -ExecutionPolicy Bypass -File suspicious_process.ps1 -Terminate

Python:

# 安装依赖
pip install psutil
# 运行
python3 suspicious_process.py

注意事项

权限问题：需要以root/管理员权限运行
误报风险：很多正常进程可能被标记为可疑
进程依赖：终止重要系统进程可能导致系统不稳定
法律合规：确保在授权范围内使用

建议在实际使用前先在测试环境验证,并根据您的具体需求调整检测规则和阈值。