Address OpenSearch password frequency list false positives (chainguar…

…d-dev#416) * Address OpenSearch password frequency list false positives Signed-off-by: egibs <[email protected]> * Update samples Signed-off-by: egibs <[email protected]> --------- Signed-off-by: egibs <[email protected]>
egibs · Aug 20, 2024 · dd5651d · dd5651d
1 parent cf15028
commit dd5651d
Show file tree

Hide file tree

Showing 5 changed files with 2 additions and 0 deletions.
diff --git a/rules/combo/botnet/passwords.yara b/rules/combo/botnet/passwords.yara
@@ -23,6 +23,8 @@ rule router_password_references : critical {
     $f_passw0rd = "Passw0rd"
     $f_admin123 = "admin123"
     $f_Admin123 = "Admin123"
+    $not_frequency_list = "var frequency_lists;frequency_lists={passwords:"
+    $not_frequency_list2 = {76 61 72 20 66 72 65 71 75 65 6E 63 79 5F 6C 69 73 74 73 3B 0A 0A 66 72 65 71 75 65 6E 63 79 5F 6C 69 73 74 73 20 3D 20 7B 0A 20 20 70 61 73 73 77 6F 72 64 73 3A 20}
     $not_onepassword_sdk = "github.com/1password/onepassword-sdk"
   condition:
     8 of ($f*) and none of ($not*)

diff --git a/samples.tar.gz.aa b/samples.tar.gz.aa
diff --git a/samples.tar.gz.ab b/samples.tar.gz.ab
diff --git a/samples.tar.gz.ac b/samples.tar.gz.ac
diff --git a/samples.tar.gz.ad b/samples.tar.gz.ad