From a3d417fe36b432c8dc7917c520dd5cb9f889862e Mon Sep 17 00:00:00 2001 From: egibs <20933572+egibs@users.noreply.github.com> Date: Tue, 1 Oct 2024 08:02:53 -0500 Subject: [PATCH 1/4] Address false positives seen with jupyterhub and reflex Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> --- rules/combo/degrader/edr_killer.yara | 10 +++++-- rules/combo/stealer/browser.yara | 4 ++- rules/obfuscation/js/char_codes.yara | 11 ++++--- rules/obfuscation/js/function_spam.yara | 6 +++- .../clean/bootstrap.bundle.min.js.simple | 4 +++ .../javascript/clean/index-DVt3E1Ef.js.simple | 10 +++++++ .../javascript/clean/sw.bundle.js.simple | 14 +++++++++ test_data/linux/clean/api.json.simple | 29 +++++++++++++++++++ .../playwright/async_api/_generated.py.simple | 22 ++++++++++++++ .../playwright/sync_api/_generated.py.simple | 22 ++++++++++++++ test_data/refresh-testdata.sh | 2 +- test_data/windows/clean/PrintDeps.exe.simple | 3 ++ 12 files changed, 127 insertions(+), 10 deletions(-) create mode 100644 test_data/javascript/clean/bootstrap.bundle.min.js.simple create mode 100644 test_data/javascript/clean/index-DVt3E1Ef.js.simple create mode 100644 test_data/javascript/clean/sw.bundle.js.simple create mode 100644 test_data/linux/clean/api.json.simple create mode 100644 test_data/python/clean/playwright/async_api/_generated.py.simple create mode 100644 test_data/python/clean/playwright/sync_api/_generated.py.simple create mode 100644 test_data/windows/clean/PrintDeps.exe.simple diff --git a/rules/combo/degrader/edr_killer.yara b/rules/combo/degrader/edr_killer.yara index 31282266f..977aa897e 100644 --- a/rules/combo/degrader/edr_killer.yara +++ b/rules/combo/degrader/edr_killer.yara @@ -11,8 +11,10 @@ rule win_kill_proc_likely : high { $debug_uhf = "UnhandledExceptionFilter" $kill_gmh = "GetModuleHandle" $kill_tp = "TerminateProcess" + + $not_printdeps_exe = {55 73 61 67 65 3A 0A 20 20 50 72 69 6E 74 44 65 70 73 20 46 49 4C 45 2E 2E 2E 00 00 00 00 00 56 65 72 73 69 6F 6E 3A 20 72 00 00 25 70 00 00 65 45 00 00 70 50} condition: - filesize < 1MB and 1 of ($kill*) and 2 of ($debug*) and 1 of ($f*) + filesize < 1MB and 1 of ($kill*) and 2 of ($debug*) and 1 of ($f*) and none of ($not_*) } rule win_kill_proc : critical { @@ -28,8 +30,10 @@ rule win_kill_proc : critical { $debug_uhf = "UnhandledExceptionFilter" $kill_gmh = "GetModuleHandle" $kill_tp = "TerminateProcess" + + $not_printdeps_exe = {55 73 61 67 65 3A 0A 20 20 50 72 69 6E 74 44 65 70 73 20 46 49 4C 45 2E 2E 2E 00 00 00 00 00 56 65 72 73 69 6F 6E 3A 20 72 00 00 25 70 00 00 65 45 00 00 70 50} condition: - filesize < 1MB and all of ($kill*) and 3 of ($debug*) and 1 of ($f*) + filesize < 1MB and all of ($kill*) and 3 of ($debug*) and 1 of ($f*) and none of ($not_*) } rule edr_stopper : critical { @@ -40,4 +44,4 @@ rule edr_stopper : critical { $stop = "stopservice" condition: filesize < 1MB and $stop and any of ($kind*) -} \ No newline at end of file +} diff --git a/rules/combo/stealer/browser.yara b/rules/combo/stealer/browser.yara index 495e03aad..c5a10f3c6 100644 --- a/rules/combo/stealer/browser.yara +++ b/rules/combo/stealer/browser.yara @@ -60,6 +60,8 @@ rule multiple_browser_refs : critical { $not_ff_js = "Firefox can even throw an error" $not_generated_comment = "// This file is generated" $not_generated_file = "/utils/generate_types/index.js" + $not_microsoft = "Copyright (c) Microsoft Corporation." + $not_microsoft_playright = "Microsoft.Playwright" condition: 2 of ($name*) and 3 of ($fs*) and none of ($not*) } @@ -152,4 +154,4 @@ rule chrome_encrypted_cookies : critical { $select = /SELECT.{0,64}encrypted_value{0,64}cookies/ condition: $select -} \ No newline at end of file +} diff --git a/rules/obfuscation/js/char_codes.yara b/rules/obfuscation/js/char_codes.yara index eca3b342f..1a7fdb616 100644 --- a/rules/obfuscation/js/char_codes.yara +++ b/rules/obfuscation/js/char_codes.yara @@ -13,9 +13,12 @@ rule child_process : critical { $a_shift = "shift" $a_push = "push" - $const = "const " - $function = "function(" - $return = "{return" + $a_const = "const " + $a_function = "function(" + $a_return = "{return" + + $not_sw_bundle = "Recorded click position in absolute coordinates did not match the center of the clicked element." + $not_sw_bundle2 = "This is likely due to a difference between the test runner and the trace viewer operating systems." condition: - filesize < 128KB and all of them + filesize < 128KB and all of ($a_*) and none of ($not_*) } diff --git a/rules/obfuscation/js/function_spam.yara b/rules/obfuscation/js/function_spam.yara index 1df70165f..1ba58da80 100644 --- a/rules/obfuscation/js/function_spam.yara +++ b/rules/obfuscation/js/function_spam.yara @@ -5,6 +5,10 @@ rule js_const_func_obfuscation : critical { $const = "const " $function = "function(" $return = "{return" + + $not_bootstrap = "* Copyright 2011-2024 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors)" + $not_fb = "Copyright (c) Facebook, Inc. and its affiliates." + $not_mit = "This source code is licensed under the MIT license found in the * LICENSE file in the root directory of this source tree." condition: - filesize < 256KB and #const > 32 and #function > 48 and #return > 64 + filesize < 256KB and #const > 32 and #function > 48 and #return > 64 and none of ($not_*) } diff --git a/test_data/javascript/clean/bootstrap.bundle.min.js.simple b/test_data/javascript/clean/bootstrap.bundle.min.js.simple new file mode 100644 index 000000000..bc7bf284b --- /dev/null +++ b/test_data/javascript/clean/bootstrap.bundle.min.js.simple @@ -0,0 +1,4 @@ +# javascript/clean/bootstrap.bundle.min.js +encoding/json/decode +ref/site/url +time/clock/sleep diff --git a/test_data/javascript/clean/index-DVt3E1Ef.js.simple b/test_data/javascript/clean/index-DVt3E1Ef.js.simple new file mode 100644 index 000000000..c7f878653 --- /dev/null +++ b/test_data/javascript/clean/index-DVt3E1Ef.js.simple @@ -0,0 +1,10 @@ +# javascript/clean/index-DVt3E1Ef.js +encoding/json/decode +encoding/json/encode +evasion/int_to_char +exec/cmd +fs/mount +net/download +ref/site/url +ref/words/password +techniques/code_eval diff --git a/test_data/javascript/clean/sw.bundle.js.simple b/test_data/javascript/clean/sw.bundle.js.simple new file mode 100644 index 000000000..1d378a327 --- /dev/null +++ b/test_data/javascript/clean/sw.bundle.js.simple @@ -0,0 +1,14 @@ +# javascript/clean/sw.bundle.js +archives/zip +encoding/base64 +encoding/json/decode +encoding/json/encode +evasion/int_to_char +fd/read +fd/write +kernel/platform +net/upload +net/url +obfuscation/js/high_entropy +ref/site/url +ref/words/password diff --git a/test_data/linux/clean/api.json.simple b/test_data/linux/clean/api.json.simple new file mode 100644 index 000000000..4c41f9c45 --- /dev/null +++ b/test_data/linux/clean/api.json.simple @@ -0,0 +1,29 @@ +# linux/clean/api.json +archives/zip +combo/recon/system_network +encoding/json/decode +encoding/json/encode +env/USER +fs/file/delete/forcibly +net/download +net/http/auth +net/http/cookies +net/http/form/upload +net/http/post +net/http/request +net/socket/listen +net/socket/send +net/socks5 +net/upload +net/url +net/url/encode +net/websocket +ref/daemon +ref/ip_port +ref/path/tmp +ref/site/url +ref/words/agent +ref/words/intercept +ref/words/password +ref/words/server_address +techniques/code_eval diff --git a/test_data/python/clean/playwright/async_api/_generated.py.simple b/test_data/python/clean/playwright/async_api/_generated.py.simple new file mode 100644 index 000000000..5afa27fce --- /dev/null +++ b/test_data/python/clean/playwright/async_api/_generated.py.simple @@ -0,0 +1,22 @@ +# python/clean/playwright/async_api/_generated.py +archives/zip +combo/recon/system_network +encoding/json/decode +fs/file/delete/forcibly +net/download +net/http/cookies +net/http/form/upload +net/http/post +net/http/request +net/socket/listen +net/socket/send +net/upload +net/url +net/url/encode +net/websocket +ref/path/tmp +ref/site/url +ref/words/agent +ref/words/intercept +ref/words/password +ref/words/server_address diff --git a/test_data/python/clean/playwright/sync_api/_generated.py.simple b/test_data/python/clean/playwright/sync_api/_generated.py.simple new file mode 100644 index 000000000..4daa557db --- /dev/null +++ b/test_data/python/clean/playwright/sync_api/_generated.py.simple @@ -0,0 +1,22 @@ +# python/clean/playwright/sync_api/_generated.py +archives/zip +combo/recon/system_network +encoding/json/decode +fs/file/delete/forcibly +net/download +net/http/cookies +net/http/form/upload +net/http/post +net/http/request +net/socket/listen +net/socket/send +net/upload +net/url +net/url/encode +net/websocket +ref/path/tmp +ref/site/url +ref/words/agent +ref/words/intercept +ref/words/password +ref/words/server_address diff --git a/test_data/refresh-testdata.sh b/test_data/refresh-testdata.sh index f350feb99..d7f91e4bf 100755 --- a/test_data/refresh-testdata.sh +++ b/test_data/refresh-testdata.sh @@ -127,5 +127,5 @@ for f in $(find "${test_data}" -name "*.json"); do done echo "processing queue with length: $(wc -l ${qscript})" -tr '\n' '\0' <"${qscript}" | xargs -0 -n1 -P"${MAX_PROCS}" -I% sh -c '%' +tr '\n' '\0' <"${qscript}" | xargs -0 -n1 -P"${MAX_PROCS}" -J% sh -c '%' echo "test data regeneration complete!!" diff --git a/test_data/windows/clean/PrintDeps.exe.simple b/test_data/windows/clean/PrintDeps.exe.simple new file mode 100644 index 000000000..90587dbc8 --- /dev/null +++ b/test_data/windows/clean/PrintDeps.exe.simple @@ -0,0 +1,3 @@ +# windows/clean/PrintDeps.exe +data/emdedded/app/manifest +evasion/anti/debugger From 7cb03422ad034cf96dd48709b308b1e1398f1b83 Mon Sep 17 00:00:00 2001 From: egibs <20933572+egibs@users.noreply.github.com> Date: Tue, 1 Oct 2024 08:48:50 -0500 Subject: [PATCH 2/4] Fix typo Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> --- rules/combo/stealer/browser.yara | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/combo/stealer/browser.yara b/rules/combo/stealer/browser.yara index c5a10f3c6..41c422740 100644 --- a/rules/combo/stealer/browser.yara +++ b/rules/combo/stealer/browser.yara @@ -61,7 +61,7 @@ rule multiple_browser_refs : critical { $not_generated_comment = "// This file is generated" $not_generated_file = "/utils/generate_types/index.js" $not_microsoft = "Copyright (c) Microsoft Corporation." - $not_microsoft_playright = "Microsoft.Playwright" + $not_microsoft_playwright = "Microsoft.Playwright" condition: 2 of ($name*) and 3 of ($fs*) and none of ($not*) } From bd8a2d8e3f4214ec1d38d714afb86f6aae807c32 Mon Sep 17 00:00:00 2001 From: egibs <20933572+egibs@users.noreply.github.com> Date: Tue, 1 Oct 2024 12:56:15 -0500 Subject: [PATCH 3/4] Address false positives with argocd and grafana Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> --- pkg/compile/compile.go | 1 + rules/combo/stealer/crypto.yara | 4 +++- rules/obfuscation/js/function_spam.yara | 13 ++++++++++++- rules/obfuscation/js/parseInt.yara | 4 +++- 4 files changed, 19 insertions(+), 3 deletions(-) diff --git a/pkg/compile/compile.go b/pkg/compile/compile.go index 2ec960a08..2cc3a9c05 100644 --- a/pkg/compile/compile.go +++ b/pkg/compile/compile.go @@ -31,6 +31,7 @@ var badRules = map[string]bool{ "ELASTIC_Macos_Creddump_Keychainaccess_535C1511": true, "SIGNATURE_BASE_Reconcommands_In_File": true, "SIGNATURE_BASE_Apt_CN_Tetrisplugins_JS": true, + "CAPE_Sparkrat": true, // ThreatHunting Keywords (some duplicates) "Adobe_XMP_Identifier": true, "Antivirus_Signature_signature_keyword": true, diff --git a/rules/combo/stealer/crypto.yara b/rules/combo/stealer/crypto.yara index c90e49ce4..1f89c6e85 100644 --- a/rules/combo/stealer/crypto.yara +++ b/rules/combo/stealer/crypto.yara @@ -11,6 +11,8 @@ rule js_crypto_stealer : critical { $url = /https{0,1}:\/\/[\w][\w\.\/\-_\?=\@]{8,64}/ $POST = "POST" + + $not_grafana = "self.webpackChunkgrafana=self.webpackChunkgrafana" condition: - filesize < 50KB and $url and $POST and any of ($pk*) + filesize < 50KB and $url and $POST and any of ($pk*) and none of ($not_*) } diff --git a/rules/obfuscation/js/function_spam.yara b/rules/obfuscation/js/function_spam.yara index 1ba58da80..4cc928244 100644 --- a/rules/obfuscation/js/function_spam.yara +++ b/rules/obfuscation/js/function_spam.yara @@ -6,9 +6,20 @@ rule js_const_func_obfuscation : critical { $function = "function(" $return = "{return" - $not_bootstrap = "* Copyright 2011-2024 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors)" + $not_bootstrap = "* Copyright 2011-2024 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors)" + $not_bindonce1 = "* Bindonce - Zero watches binding for AngularJs" + $not_bindonce2 = "@link https://github.com/Pasvaz/bindonce" + $not_bindonce3 = "@author Pasquale Vazzana " $not_fb = "Copyright (c) Facebook, Inc. and its affiliates." + $not_floating_ui_react_dom = "@floating-ui/react-dom" + $not_grafana1 = "/*! For license information please see module.js.LICENSE.txt */" + $not_grafana2 = "@grafana/data" + $not_grafana3 = "@grafana/runtime" + $not_grafana4 = "@grafana/ui" + $not_lodash = "Released under MIT license " + $not_lodash2 = {4C 6F 64 61 73 68 20 3C 68 74 74 70 73 3A 2F 2F 6C 6F 64 61 73 68 2E 63 6F 6D 2F 3E} $not_mit = "This source code is licensed under the MIT license found in the * LICENSE file in the root directory of this source tree." + $not_openjs = "Copyright OpenJS Foundation and other contributors " condition: filesize < 256KB and #const > 32 and #function > 48 and #return > 64 and none of ($not_*) } diff --git a/rules/obfuscation/js/parseInt.yara b/rules/obfuscation/js/parseInt.yara index 236d0c13a..0125846df 100644 --- a/rules/obfuscation/js/parseInt.yara +++ b/rules/obfuscation/js/parseInt.yara @@ -7,6 +7,8 @@ rule js_const_func_obfuscation : critical { $function = "function(" $return = "{return" $parseInt = "parseInt" + + $not_grafana = "self.webpackChunkgrafana=self.webpackChunkgrafana" condition: - filesize < 256KB and #const > 16 and #function > 32 and #parseInt > 8 and #return > 32 + filesize < 256KB and #const > 16 and #function > 32 and #parseInt > 8 and #return > 32 and none of ($not_*) } From 40df779b9864244d5384e256afcf894f39f678eb Mon Sep 17 00:00:00 2001 From: egibs <20933572+egibs@users.noreply.github.com> Date: Tue, 1 Oct 2024 16:05:12 -0500 Subject: [PATCH 4/4] Tweak problematic rules to non-critical; remove samples Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> --- rules/combo/degrader/edr_killer.yara | 8 ++--- rules/combo/stealer/browser.yara | 4 +-- rules/combo/stealer/crypto.yara | 5 ++-- rules/obfuscation/js/char_codes.yara | 12 ++++---- rules/obfuscation/js/function_spam.yara | 18 ++---------- rules/obfuscation/js/parseInt.yara | 5 ++-- .../clean/bootstrap.bundle.min.js.simple | 4 --- .../javascript/clean/index-DVt3E1Ef.js.simple | 10 ------- .../javascript/clean/sw.bundle.js.simple | 14 --------- test_data/linux/clean/api.json.simple | 29 ------------------- .../playwright/async_api/_generated.py.simple | 22 -------------- .../playwright/sync_api/_generated.py.simple | 22 -------------- test_data/windows/clean/PrintDeps.exe.simple | 3 -- 13 files changed, 15 insertions(+), 141 deletions(-) delete mode 100644 test_data/javascript/clean/bootstrap.bundle.min.js.simple delete mode 100644 test_data/javascript/clean/index-DVt3E1Ef.js.simple delete mode 100644 test_data/javascript/clean/sw.bundle.js.simple delete mode 100644 test_data/linux/clean/api.json.simple delete mode 100644 test_data/python/clean/playwright/async_api/_generated.py.simple delete mode 100644 test_data/python/clean/playwright/sync_api/_generated.py.simple delete mode 100644 test_data/windows/clean/PrintDeps.exe.simple diff --git a/rules/combo/degrader/edr_killer.yara b/rules/combo/degrader/edr_killer.yara index 977aa897e..882308e00 100644 --- a/rules/combo/degrader/edr_killer.yara +++ b/rules/combo/degrader/edr_killer.yara @@ -12,12 +12,11 @@ rule win_kill_proc_likely : high { $kill_gmh = "GetModuleHandle" $kill_tp = "TerminateProcess" - $not_printdeps_exe = {55 73 61 67 65 3A 0A 20 20 50 72 69 6E 74 44 65 70 73 20 46 49 4C 45 2E 2E 2E 00 00 00 00 00 56 65 72 73 69 6F 6E 3A 20 72 00 00 25 70 00 00 65 45 00 00 70 50} condition: - filesize < 1MB and 1 of ($kill*) and 2 of ($debug*) and 1 of ($f*) and none of ($not_*) + filesize < 1MB and 1 of ($kill*) and 2 of ($debug*) and 1 of ($f*) } -rule win_kill_proc : critical { +rule win_kill_proc : high { meta: description = "Windows EDR/Antivirus bypass" strings: @@ -31,9 +30,8 @@ rule win_kill_proc : critical { $kill_gmh = "GetModuleHandle" $kill_tp = "TerminateProcess" - $not_printdeps_exe = {55 73 61 67 65 3A 0A 20 20 50 72 69 6E 74 44 65 70 73 20 46 49 4C 45 2E 2E 2E 00 00 00 00 00 56 65 72 73 69 6F 6E 3A 20 72 00 00 25 70 00 00 65 45 00 00 70 50} condition: - filesize < 1MB and all of ($kill*) and 3 of ($debug*) and 1 of ($f*) and none of ($not_*) + filesize < 1MB and all of ($kill*) and 3 of ($debug*) and 1 of ($f*) } rule edr_stopper : critical { diff --git a/rules/combo/stealer/browser.yara b/rules/combo/stealer/browser.yara index 41c422740..f7c935b7a 100644 --- a/rules/combo/stealer/browser.yara +++ b/rules/combo/stealer/browser.yara @@ -21,7 +21,7 @@ rule multiple_browser_credentials : high { 3 of ($c_*) and none of ($not_*) } -rule multiple_browser_refs : critical { +rule multiple_browser_refs : high { meta: description = "Makes references to multiple browser credentials" hash_1985_actions_UserGet = "e3a457ec75e3a042fb34fa6d49e0e833265d21d26c4e0119aaa1b6ec8a9460ec" @@ -60,8 +60,6 @@ rule multiple_browser_refs : critical { $not_ff_js = "Firefox can even throw an error" $not_generated_comment = "// This file is generated" $not_generated_file = "/utils/generate_types/index.js" - $not_microsoft = "Copyright (c) Microsoft Corporation." - $not_microsoft_playwright = "Microsoft.Playwright" condition: 2 of ($name*) and 3 of ($fs*) and none of ($not*) } diff --git a/rules/combo/stealer/crypto.yara b/rules/combo/stealer/crypto.yara index 1f89c6e85..591008ee3 100644 --- a/rules/combo/stealer/crypto.yara +++ b/rules/combo/stealer/crypto.yara @@ -1,4 +1,4 @@ -rule js_crypto_stealer : critical { +rule js_crypto_stealer : high { meta: description = "steals private cryptographic data" strings: @@ -12,7 +12,6 @@ rule js_crypto_stealer : critical { $POST = "POST" - $not_grafana = "self.webpackChunkgrafana=self.webpackChunkgrafana" condition: - filesize < 50KB and $url and $POST and any of ($pk*) and none of ($not_*) + filesize < 50KB and $url and $POST and any of ($pk*) } diff --git a/rules/obfuscation/js/char_codes.yara b/rules/obfuscation/js/char_codes.yara index 1a7fdb616..f67962494 100644 --- a/rules/obfuscation/js/char_codes.yara +++ b/rules/obfuscation/js/char_codes.yara @@ -1,6 +1,6 @@ import "math" -rule child_process : critical { +rule child_process : high { meta: description = "obfuscated javascript that relies on character manipulation" filetypes = "javascript" @@ -13,12 +13,10 @@ rule child_process : critical { $a_shift = "shift" $a_push = "push" - $a_const = "const " - $a_function = "function(" - $a_return = "{return" + $const = "const " + $function = "function(" + $return = "{return" - $not_sw_bundle = "Recorded click position in absolute coordinates did not match the center of the clicked element." - $not_sw_bundle2 = "This is likely due to a difference between the test runner and the trace viewer operating systems." condition: - filesize < 128KB and all of ($a_*) and none of ($not_*) + filesize < 128KB and all of them } diff --git a/rules/obfuscation/js/function_spam.yara b/rules/obfuscation/js/function_spam.yara index 4cc928244..0d6f36fbf 100644 --- a/rules/obfuscation/js/function_spam.yara +++ b/rules/obfuscation/js/function_spam.yara @@ -1,4 +1,4 @@ -rule js_const_func_obfuscation : critical { +rule js_const_func_obfuscation : medium { meta: description = "javascript obfuscation (excessive const functions)" strings: @@ -6,20 +6,6 @@ rule js_const_func_obfuscation : critical { $function = "function(" $return = "{return" - $not_bootstrap = "* Copyright 2011-2024 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors)" - $not_bindonce1 = "* Bindonce - Zero watches binding for AngularJs" - $not_bindonce2 = "@link https://github.com/Pasvaz/bindonce" - $not_bindonce3 = "@author Pasquale Vazzana " - $not_fb = "Copyright (c) Facebook, Inc. and its affiliates." - $not_floating_ui_react_dom = "@floating-ui/react-dom" - $not_grafana1 = "/*! For license information please see module.js.LICENSE.txt */" - $not_grafana2 = "@grafana/data" - $not_grafana3 = "@grafana/runtime" - $not_grafana4 = "@grafana/ui" - $not_lodash = "Released under MIT license " - $not_lodash2 = {4C 6F 64 61 73 68 20 3C 68 74 74 70 73 3A 2F 2F 6C 6F 64 61 73 68 2E 63 6F 6D 2F 3E} - $not_mit = "This source code is licensed under the MIT license found in the * LICENSE file in the root directory of this source tree." - $not_openjs = "Copyright OpenJS Foundation and other contributors " condition: - filesize < 256KB and #const > 32 and #function > 48 and #return > 64 and none of ($not_*) + filesize < 256KB and #const > 32 and #function > 48 and #return > 64 } diff --git a/rules/obfuscation/js/parseInt.yara b/rules/obfuscation/js/parseInt.yara index 0125846df..d2b6de23a 100644 --- a/rules/obfuscation/js/parseInt.yara +++ b/rules/obfuscation/js/parseInt.yara @@ -1,4 +1,4 @@ -rule js_const_func_obfuscation : critical { +rule js_const_func_obfuscation : high { meta: description = "javascript obfuscation (integer parsing)" filetypes = "javascript" @@ -8,7 +8,6 @@ rule js_const_func_obfuscation : critical { $return = "{return" $parseInt = "parseInt" - $not_grafana = "self.webpackChunkgrafana=self.webpackChunkgrafana" condition: - filesize < 256KB and #const > 16 and #function > 32 and #parseInt > 8 and #return > 32 and none of ($not_*) + filesize < 256KB and #const > 16 and #function > 32 and #parseInt > 8 and #return > 32 } diff --git a/test_data/javascript/clean/bootstrap.bundle.min.js.simple b/test_data/javascript/clean/bootstrap.bundle.min.js.simple deleted file mode 100644 index bc7bf284b..000000000 --- a/test_data/javascript/clean/bootstrap.bundle.min.js.simple +++ /dev/null @@ -1,4 +0,0 @@ -# javascript/clean/bootstrap.bundle.min.js -encoding/json/decode -ref/site/url -time/clock/sleep diff --git a/test_data/javascript/clean/index-DVt3E1Ef.js.simple b/test_data/javascript/clean/index-DVt3E1Ef.js.simple deleted file mode 100644 index c7f878653..000000000 --- a/test_data/javascript/clean/index-DVt3E1Ef.js.simple +++ /dev/null @@ -1,10 +0,0 @@ -# javascript/clean/index-DVt3E1Ef.js -encoding/json/decode -encoding/json/encode -evasion/int_to_char -exec/cmd -fs/mount -net/download -ref/site/url -ref/words/password -techniques/code_eval diff --git a/test_data/javascript/clean/sw.bundle.js.simple b/test_data/javascript/clean/sw.bundle.js.simple deleted file mode 100644 index 1d378a327..000000000 --- a/test_data/javascript/clean/sw.bundle.js.simple +++ /dev/null @@ -1,14 +0,0 @@ -# javascript/clean/sw.bundle.js -archives/zip -encoding/base64 -encoding/json/decode -encoding/json/encode -evasion/int_to_char -fd/read -fd/write -kernel/platform -net/upload -net/url -obfuscation/js/high_entropy -ref/site/url -ref/words/password diff --git a/test_data/linux/clean/api.json.simple b/test_data/linux/clean/api.json.simple deleted file mode 100644 index 4c41f9c45..000000000 --- a/test_data/linux/clean/api.json.simple +++ /dev/null @@ -1,29 +0,0 @@ -# linux/clean/api.json -archives/zip -combo/recon/system_network -encoding/json/decode -encoding/json/encode -env/USER -fs/file/delete/forcibly -net/download -net/http/auth -net/http/cookies -net/http/form/upload -net/http/post -net/http/request -net/socket/listen -net/socket/send -net/socks5 -net/upload -net/url -net/url/encode -net/websocket -ref/daemon -ref/ip_port -ref/path/tmp -ref/site/url -ref/words/agent -ref/words/intercept -ref/words/password -ref/words/server_address -techniques/code_eval diff --git a/test_data/python/clean/playwright/async_api/_generated.py.simple b/test_data/python/clean/playwright/async_api/_generated.py.simple deleted file mode 100644 index 5afa27fce..000000000 --- a/test_data/python/clean/playwright/async_api/_generated.py.simple +++ /dev/null @@ -1,22 +0,0 @@ -# python/clean/playwright/async_api/_generated.py -archives/zip -combo/recon/system_network -encoding/json/decode -fs/file/delete/forcibly -net/download -net/http/cookies -net/http/form/upload -net/http/post -net/http/request -net/socket/listen -net/socket/send -net/upload -net/url -net/url/encode -net/websocket -ref/path/tmp -ref/site/url -ref/words/agent -ref/words/intercept -ref/words/password -ref/words/server_address diff --git a/test_data/python/clean/playwright/sync_api/_generated.py.simple b/test_data/python/clean/playwright/sync_api/_generated.py.simple deleted file mode 100644 index 4daa557db..000000000 --- a/test_data/python/clean/playwright/sync_api/_generated.py.simple +++ /dev/null @@ -1,22 +0,0 @@ -# python/clean/playwright/sync_api/_generated.py -archives/zip -combo/recon/system_network -encoding/json/decode -fs/file/delete/forcibly -net/download -net/http/cookies -net/http/form/upload -net/http/post -net/http/request -net/socket/listen -net/socket/send -net/upload -net/url -net/url/encode -net/websocket -ref/path/tmp -ref/site/url -ref/words/agent -ref/words/intercept -ref/words/password -ref/words/server_address diff --git a/test_data/windows/clean/PrintDeps.exe.simple b/test_data/windows/clean/PrintDeps.exe.simple deleted file mode 100644 index 90587dbc8..000000000 --- a/test_data/windows/clean/PrintDeps.exe.simple +++ /dev/null @@ -1,3 +0,0 @@ -# windows/clean/PrintDeps.exe -data/emdedded/app/manifest -evasion/anti/debugger