Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

New false positive rules #502

Merged
merged 9 commits into from
Oct 8, 2024
Merged

New false positive rules #502

Show file tree
Hide file tree
Changes from 7 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
79d38d4
New false positive rules
egibs Oct 7, 2024
e8fdd68
Refresh test data
egibs Oct 7, 2024
8832a03
Merge branch 'main' into 20241007-false-positve-fixes
egibs Oct 7, 2024
d099a53
Fix Vitess rule file name
egibs Oct 7, 2024
3386759
Appease the linter
egibs Oct 7, 2024
65ea6e1
Overrides don't exist in the behaviorMap
egibs Oct 7, 2024
e716ba1
Address PR comments; re-add override removal from map
egibs Oct 7, 2024
a122a4c
Run gofmt
egibs Oct 7, 2024
d774c56
Run make refresh-sample-testdata
egibs Oct 7, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions pkg/action/scan.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -211,7 +211,7 @@ func cachedRules(ctx context.Context, fss []fs.FS) (*yara.Rules, error) {

// recursiveScan recursively YARA scans the configured paths - handling archives and OCI images.
//
//nolint:gocognit // ignoring complexity of 101 > 98
//nolint:gocognit,cyclop // ignoring complexity of 101,38
func recursiveScan(ctx context.Context, c malcontent.Config) (*malcontent.Report, error) {
logger := clog.FromContext(ctx)
logger.Debug("recursive scan", slog.Any("config", c))
Expand All @@ -225,7 +225,9 @@ func recursiveScan(ctx context.Context, c malcontent.Config) (*malcontent.Report
var scanPathFindings sync.Map

for _, scanPath := range c.ScanPaths {
c.Renderer.Scanning(ctx, scanPath)
if c.Renderer != nil {
c.Renderer.Scanning(ctx, scanPath)
}
logger.Debug("recursive scan", slog.Any("scanPath", scanPath))
imageURI := ""
ociExtractPath := ""
Expand Down
3 changes: 3 additions & 0 deletions pkg/compile/compile.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
// Copyright 2024 Chainguard, Inc.

Check failure on line 1 in pkg/compile/compile.go

View workflow job for this annotation

GitHub Actions / test 

Please run goimports.
diff --git a/pkg/compile/compile.go b/pkg/compile/compile.go
index bdcd6da..4c0f02f 100644
--- a/pkg/compile/compile.go
+++ b/pkg/compile/compile.go
@@ -60,7 +60,7 @@ var badRules = map[string]bool{
 	// TTC-CERT
 	"cve_202230190_html_payload": true,
 	// JPCERT
-	"malware_PlugX_config": true,
+	"malware_PlugX_config":   true,
 	"malware_shellcode_hash": true,
 }

Check failure on line 1 in pkg/compile/compile.go

View workflow job for this annotation

GitHub Actions / check goimports 

Please run goimports.
diff --git a/pkg/compile/compile.go b/pkg/compile/compile.go
index bdcd6da..4c0f02f 100644
--- a/pkg/compile/compile.go
+++ b/pkg/compile/compile.go
@@ -60,7 +60,7 @@ var badRules = map[string]bool{
 	// TTC-CERT
 	"cve_202230190_html_payload": true,
 	// JPCERT
-	"malware_PlugX_config": true,
+	"malware_PlugX_config":   true,
 	"malware_shellcode_hash": true,
 }

Check failure on line 1 in pkg/compile/compile.go

View workflow job for this annotation

GitHub Actions / check gofmt 

Please run gofmt -s.
diff --git a/pkg/compile/compile.go b/pkg/compile/compile.go
index bdcd6da..4c0f02f 100644
--- a/pkg/compile/compile.go
+++ b/pkg/compile/compile.go
@@ -60,7 +60,7 @@ var badRules = map[string]bool{
 	// TTC-CERT
 	"cve_202230190_html_payload": true,
 	// JPCERT
-	"malware_PlugX_config": true,
+	"malware_PlugX_config":   true,
 	"malware_shellcode_hash": true,
 }
// SPDX-License-Identifier: Apache-2.0

package compile
Expand Down Expand Up @@ -59,6 +59,9 @@
"Windows_API_Function": true,
// TTC-CERT
"cve_202230190_html_payload": true,
// JPCERT
"malware_PlugX_config": true,
"malware_shellcode_hash": true,
}

// rulesWithWarnings determines what to do with rules that have known warnings: true=keep, false=disable.
Expand Down
3 changes: 3 additions & 0 deletions pkg/report/report.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -652,6 +652,9 @@ func handleOverrides(original, override []*malcontent.Behavior) []*malcontent.Be
if b, exists := behaviorMap[o.Override]; exists {
b.RiskLevel = o.RiskLevel
b.RiskScore = o.RiskScore

// Delete the override rule from the behavior map
delete(behaviorMap, o.RuleName)
tstromberg marked this conversation as resolved.
Show resolved Hide resolved
}
}

Expand Down
8 changes: 5 additions & 3 deletions rules/combo/dropper/shell.yara
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ rule curl_chmod_relative_run_tiny : critical {
filesize < 6KB and all of them
}

rule curl_tor_chmod_relative_run : critical {
rule curl_tor_chmod_relative_run : high {
meta:
description = "change dir, fetch file via tor, make it executable, and run it"
hash_2024_Downloads_4ba700b0e86da21d3dcd6b450893901c252bf817bd8792548fc8f389ee5aec78 = "fd3e21b8e2d8acf196cb63a23fc336d7078e72c2c3e168ee7851ea2bef713588"
Expand All @@ -55,8 +55,10 @@ rule curl_tor_chmod_relative_run : critical {
$curl = /curl [\-\w \$\@\{\w\/\.\:]{0,96}/
$chmod = /chmod [\+\-\w \$\@\{\w\/\.]{0,64}/
$dot_slash = /\.\/[a-z]{1,2}[a-z\.\/\- ]{0,32}/ fullword

$not_go = "listen.onionndots"
condition:
any of ($tor*) and $cd and $curl and $chmod and $dot_slash
any of ($tor*) and $cd and $curl and $chmod and $dot_slash and filesize < 1MB and none of ($not*)
}


Expand Down Expand Up @@ -167,4 +169,4 @@ rule obsessive_dropper : critical {
$cmd_chmod = "chmod" fullword
condition:
filesize < 768 and any of ($http*) and 2 of ($tool*) and any of ($cmd*)
}
}
11 changes: 11 additions & 0 deletions rules/false_positives/datadog.yara
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
rule ddtrace_rules_json : override {
meta:
description = "appsec/rules.json"
linux_multi_persist = "medium"
strings:
$datadog = /[Dd]atadog/
$datadog_generic = /[Dd]atadog \w{0,32}/
$datadog_test_scanner = "Datadog test scanner"
condition:
all of them
}
15 changes: 15 additions & 0 deletions rules/false_positives/k8s_dashboard.yara
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
rule mode_php_js : override {
meta:
description = "mode-php.js, mode-php_laravel_blade.js"
php_executor = "high"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Addressed in e716ba1 (#502).

strings:
$ace_define = "ace.define"
$ace_lib = "ace/lib"
$ace_mode = "ace/mode"
$ace_require = "ace.require"
$mode_php_laravel_blade = "ace/mode/php_laravel_blade"
$php_worker = "ace/mode/php_worker"
$php_worker2 = "PhpWorker"
condition:
6 of them
}
10 changes: 10 additions & 0 deletions rules/false_positives/nvim.yara
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
rule nvim_binary : override {
meta:
description = "nvim"
linux_multi_persist = "medium"
strings:
$nvim_generic = /nvim_\w{0,32}/
$nvim_path = "/home/build/src/nvim"
egibs marked this conversation as resolved.
Show resolved Hide resolved
condition:
all of them
}
13 changes: 13 additions & 0 deletions rules/false_positives/rancher.yara
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
rule pull_scripts : override {
meta:
curl_chmod_relative_run_tiny = "medium"
description = "pull-scripts"
strings:
$binary = "BINARY_NAME=\"charts-build-scripts_${OS}_${ARCH}.exe\""
$chmod = "chmod +x ./bin/charts-build-scripts"
$echo1 = "echo \"Downloading charts-build-scripts version ${CHARTS_BUILD_SCRIPTS_REPO}@${CHARTS_BUILD_SCRIPT_VERSION}\""
$echo2 = "echo \"${BINARY_NAME} => ./bin/charts-build-scripts\""
$version_cmd = "./bin/charts-build-scripts --version"
condition:
all of them
}
13 changes: 13 additions & 0 deletions rules/false_positives/tensorflow_model_analysis.yara
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
rule tfjs_predict_extractor_util : override {
meta:
description = "tfjs_predict_extractor_util.py"
py_dropper_chmod = "medium"
strings:
$copyright_google = "# Copyright 2019 Google LLC"
$subprocess_chmod = "subprocess.check_call(['chmod', '+x', path])"
$tfjs_predict_extractor = "Utilities for tfjs_predict_extractor."
$tfjs_url_linux = "http://storage.googleapis.com/tfjs-inference/tfjs-inference-linux"
$tfjs_url_macos = "http://storage.googleapis.com/tfjs-inference/tfjs-inference-macos"
condition:
all of them
}
11 changes: 11 additions & 0 deletions rules/false_positives/trivy.yara
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
rule trivy_binary : override {
meta:
curl_tor_chmod_relative_run = "medium"
description = "trivy"
strings:
$aqua_security_trivy = "aquasecurity:trivy"
$trivy_install = "# curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh"
$trivy_repo = "github.com/aquasecurity/trivy"
condition:
all of them
}
12 changes: 12 additions & 0 deletions rules/false_positives/vitess.yara
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
rule vitess : override {
meta:
linux_multi_persist = "medium"
description = "vitess"
strings:
$issue = "This error should not happen and is a bug. Please file an issue on GitHub: https://github.com/vitessio/vitess/issues/new/choose"
$vitess = "vitess"
$vitess_io = "vitess.io"
$vitess_repo = "https://github.com/vitessio"
condition:
all of them
}
2 changes: 1 addition & 1 deletion test_data/javascript/clean/5A50D54796BB27126E03A7E25DD5D589.cache.js.simple
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,12 +20,12 @@ env/LANG
env/TEMP
env/USER
evasion/base64/decode
evasion/int_to_char
evasion/unusual_include
exec/cmd
exec/program
exec/program/background
exec/shell_command
false_positives/k8s_dashboard
fd/read
fs/directory/create
fs/directory/remove
Expand Down
1 change: 0 additions & 1 deletion test_data/javascript/clean/5D3EB8D016DDDA0665CB8CD8EEA6C537.cache.js.simple
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,6 @@ env/HOME
env/TEMP
env/USER
evasion/base64/decode
evasion/int_to_char
evasion/unusual_include
exec/cmd
exec/program
Expand Down
65 changes: 65 additions & 0 deletions test_data/javascript/clean/mode-php.js.simple
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,65 @@
# javascript/clean/mode-php.js
combo/backdoor/php
combo/net/tunnel_proxy
compression/bzip2
compression/gzip
databases/mysql
databases/sqlite
encoding/base64
encoding/reverse
env/USER
evasion/base64/decode
exec/program
exec/program/background
exec/shell_command
fs/directory/create
fs/directory/remove
fs/fifo/create
fs/file/delete
fs/file/delete/forcibly
fs/file/truncate
fs/link/read
fs/lock/update
fs/node/create
fs/permission/modify
fs/symlink/resolve
fs/watch
hash/md5
kernel/acct
kernel/hostname/get
kernel/platform
net/fetch
net/hostname/resolve
net/hostport/parse
net/http/cookies
net/http/form/upload
net/http/post
net/ip/parse
net/ip/resolve
net/ip/string
net/socket/connect
net/socket/listen
net/socket/local/address
net/socket/peer/address
net/socket/receive
net/socket/send
net/upload
net/url/encode
process/chroot
process/effective/groupid/get
process/groupid/set
process/parent_pid/get
process/userid/set
process/username/get
random/insecure
ref/daemon
ref/ip_port
ref/path/etc
ref/path/hidden
ref/site/url
ref/words/agent
ref/words/password
ref/words/plugin
ref/words/spoof
secrets/private_key
tty/pathname
65 changes: 65 additions & 0 deletions test_data/javascript/clean/mode-php_laravel_blade.js.simple
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,65 @@
# javascript/clean/mode-php_laravel_blade.js
combo/backdoor/php
combo/net/tunnel_proxy
compression/bzip2
compression/gzip
databases/mysql
databases/sqlite
encoding/base64
encoding/reverse
env/USER
evasion/base64/decode
exec/program
exec/program/background
exec/shell_command
fs/directory/create
fs/directory/remove
fs/fifo/create
fs/file/delete
fs/file/delete/forcibly
fs/file/truncate
fs/link/read
fs/lock/update
fs/node/create
fs/permission/modify
fs/symlink/resolve
fs/watch
hash/md5
kernel/acct
kernel/hostname/get
kernel/platform
net/fetch
net/hostname/resolve
net/hostport/parse
net/http/cookies
net/http/form/upload
net/http/post
net/ip/parse
net/ip/resolve
net/ip/string
net/socket/connect
net/socket/listen
net/socket/local/address
net/socket/peer/address
net/socket/receive
net/socket/send
net/upload
net/url/encode
process/chroot
process/effective/groupid/get
process/groupid/set
process/parent_pid/get
process/userid/set
process/username/get
random/insecure
ref/daemon
ref/ip_port
ref/path/etc
ref/path/hidden
ref/site/url
ref/words/agent
ref/words/password
ref/words/plugin
ref/words/spoof
secrets/private_key
tty/pathname
1 change: 0 additions & 1 deletion test_data/javascript/clean/napi_rs_runtime.js.simple
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@ data/embedded/base64/url
encoding/base64
encoding/json/decode
encoding/json/encode
evasion/int_to_char
fd/write
fs/directory/create
fs/directory/list
Expand Down
1 change: 0 additions & 1 deletion test_data/javascript/clean/securityDashboards.plugin.js.simple
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ databases/mysql
encoding/base64
encoding/json/decode
encoding/json/encode
evasion/int_to_char
evasion/xor/commands
fs/link/create
fs/lock/update
Expand Down
1 change: 0 additions & 1 deletion test_data/linux/2022.Symbiote/kerneldev.so.bkp.simple
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,5 @@
# linux/2022.Symbiote/kerneldev.so.bkp
3P/threat_hunting/keylogger
combo/stealer/pam
dylib/symbol/address
evasion/process/hide
fs/link/read
Expand Down
1 change: 0 additions & 1 deletion test_data/linux/2024.Kaiji/eight-nebraska-autumn-illinois.simple
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,6 @@
3P/elastic/threat
combo/backdoor/kill_rm
combo/botnet/systemctl
combo/dropper/binary
combo/dropper/shell
combo/stealer/linux_server
combo/stealer/ssh
Expand Down
1 change: 0 additions & 1 deletion ...024.clobber_xmrig/cba8d79949adc3c56c02fee56644f4084b7471bc5aed1c81803054f017240a72.simple
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
# linux/2024.clobber_xmrig/cba8d79949adc3c56c02fee56644f4084b7471bc5aed1c81803054f017240a72
3P/elastic/threat
3P/threat_hunting/xmrig
combo/stealer/pam
compression/gzip
crypto/aes
crypto/ecdsa
Expand Down
1 change: 0 additions & 1 deletion test_data/linux/clean/appsec-rules.json.simple
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,6 @@ databases/sqlite
device/hardware/enumeration
encoding/base64
evasion/base64/decode
evasion/int_to_char
exec/shell_command
fs/fifo/create
fs/file/times/set
Expand Down
1 change: 0 additions & 1 deletion test_data/linux/clean/chezmoi.simple
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,6 @@ env/TMPDIR
env/USER
env/get
evasion/content/length/0
evasion/int_to_char
evasion/xor/commands
exec/cmd
exec/program
Expand Down
Loading
Loading