Address false positives seen with argocd, grafana, jupyterhub, and reflex

pkg/compile/compile.go

@@ -31,6 +31,7 @@ var badRules = map[string]bool{
 	"ELASTIC_Macos_Creddump_Keychainaccess_535C1511":      true,
 	"SIGNATURE_BASE_Reconcommands_In_File":                true,
 	"SIGNATURE_BASE_Apt_CN_Tetrisplugins_JS":              true,
+	"CAPE_Sparkrat":                                       true,
 	// ThreatHunting Keywords (some duplicates)
 	"Adobe_XMP_Identifier":                       true,
 	"Antivirus_Signature_signature_keyword":      true,

rules/combo/degrader/edr_killer.yara

@@ -11,8 +11,10 @@ rule win_kill_proc_likely : high {
 	$debug_uhf = "UnhandledExceptionFilter"
 	$kill_gmh = "GetModuleHandle"
 	$kill_tp = "TerminateProcess"
+
+    $not_printdeps_exe = {55 73 61 67 65 3A 0A 20 20 50 72 69 6E 74 44 65 70 73 20 46 49 4C 45 2E 2E 2E 00 00 00 00 00 56 65 72 73 69 6F 6E 3A 20 72 00 00 25 70 00 00 65 45 00 00 70 50}
   condition:
-	filesize < 1MB and 1 of ($kill*) and 2 of ($debug*) and 1 of ($f*) 
+	filesize < 1MB and 1 of ($kill*) and 2 of ($debug*) and 1 of ($f*) and none of ($not_*)
 }
 
 rule win_kill_proc : critical {
@@ -28,8 +30,10 @@ rule win_kill_proc : critical {
 	$debug_uhf = "UnhandledExceptionFilter"
 	$kill_gmh = "GetModuleHandle"
 	$kill_tp = "TerminateProcess"
+
+    $not_printdeps_exe = {55 73 61 67 65 3A 0A 20 20 50 72 69 6E 74 44 65 70 73 20 46 49 4C 45 2E 2E 2E 00 00 00 00 00 56 65 72 73 69 6F 6E 3A 20 72 00 00 25 70 00 00 65 45 00 00 70 50}
   condition:
-	filesize < 1MB and all of ($kill*) and 3 of ($debug*) and 1 of ($f*) 
+	filesize < 1MB and all of ($kill*) and 3 of ($debug*) and 1 of ($f*) and none of ($not_*)
 }
 
 rule edr_stopper : critical {
@@ -40,4 +44,4 @@ rule edr_stopper : critical {
 	$stop = "stopservice"
   condition:
 	filesize < 1MB and $stop and any of ($kind*)
-}
+}

rules/combo/stealer/browser.yara

@@ -60,6 +60,8 @@ rule multiple_browser_refs : critical {
     $not_ff_js = "Firefox can even throw an error"
     $not_generated_comment = "// This file is generated"
     $not_generated_file = "/utils/generate_types/index.js"
+    $not_microsoft = "Copyright (c) Microsoft Corporation."
+    $not_microsoft_playwright = "Microsoft.Playwright"
   condition:
     2 of ($name*) and 3 of ($fs*) and none of ($not*)
 }
@@ -152,4 +154,4 @@ rule chrome_encrypted_cookies : critical {
 		$select = /SELECT.{0,64}encrypted_value{0,64}cookies/
 	condition:
 		$select
-}
+}

rules/combo/stealer/crypto.yara

@@ -11,6 +11,8 @@ rule js_crypto_stealer : critical {
     $url = /https{0,1}:\/\/[\w][\w\.\/\-_\?=\@]{8,64}/
 
 	$POST = "POST"
+
+	$not_grafana = "self.webpackChunkgrafana=self.webpackChunkgrafana"
   condition:
-	filesize < 50KB and $url and $POST and any of ($pk*)
+	filesize < 50KB and $url and $POST and any of ($pk*) and none of ($not_*)
 }

rules/obfuscation/js/char_codes.yara

@@ -13,9 +13,12 @@ rule child_process : critical {
 		$a_shift = "shift"
 		$a_push = "push"
 
-		$const = "const "
-		$function = "function("
-		$return = "{return"
+		$a_const = "const "
+		$a_function = "function("
+		$a_return = "{return"
+
+		$not_sw_bundle = "Recorded click position in absolute coordinates did not match the center of the clicked element."
+		$not_sw_bundle2 = "This is likely due to a difference between the test runner and the trace viewer operating systems."
 	condition:
-		filesize < 128KB and all of them
+		filesize < 128KB and all of ($a_*) and none of ($not_*)
 }

rules/obfuscation/js/function_spam.yara

@@ -5,6 +5,21 @@ rule js_const_func_obfuscation : critical {
 		$const = "const "
 		$function = "function("
 		$return = "{return"
+
+    $not_bootstrap = "* Copyright 2011-2024 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors)"
+		$not_bindonce1 = "* Bindonce - Zero watches binding for AngularJs"
+		$not_bindonce2 = "@link https://github.com/Pasvaz/bindonce"
+		$not_bindonce3 = "@author Pasquale Vazzana <pasqualevazzana@gmail.com>"
+		$not_fb = "Copyright (c) Facebook, Inc. and its affiliates."
+		$not_floating_ui_react_dom = "@floating-ui/react-dom"
+		$not_grafana1 = "/*! For license information please see module.js.LICENSE.txt */"
+		$not_grafana2 = "@grafana/data"
+		$not_grafana3 = "@grafana/runtime"
+		$not_grafana4 = "@grafana/ui"
+		$not_lodash = "Released under MIT license <https://lodash.com/license>"
+		$not_lodash2 = {4C 6F 64 61 73 68 20 3C 68 74 74 70 73 3A 2F 2F 6C 6F 64 61 73 68 2E 63 6F 6D 2F 3E}
+		$not_mit = "This source code is licensed under the MIT license found in the * LICENSE file in the root directory of this source tree."
+		$not_openjs = "Copyright OpenJS Foundation and other contributors <https://openjsf.org/>"
 	condition:
-		filesize < 256KB and #const > 32 and #function > 48 and #return > 64
+		filesize < 256KB and #const > 32 and #function > 48 and #return > 64 and none of ($not_*)
 }

rules/obfuscation/js/parseInt.yara

@@ -7,6 +7,8 @@ rule js_const_func_obfuscation : critical {
 		$function = "function("
 		$return = "{return"
 		$parseInt = "parseInt"
+
+		$not_grafana = "self.webpackChunkgrafana=self.webpackChunkgrafana"
 	condition:
-		filesize < 256KB and #const > 16 and #function > 32 and #parseInt > 8 and #return > 32
+		filesize < 256KB and #const > 16 and #function > 32 and #parseInt > 8 and #return > 32 and none of ($not_*)
 }

test_data/javascript/clean/bootstrap.bundle.min.js.simple

@@ -0,0 +1,4 @@
+# javascript/clean/bootstrap.bundle.min.js
+encoding/json/decode
+ref/site/url
+time/clock/sleep

test_data/javascript/clean/index-DVt3E1Ef.js.simple

@@ -0,0 +1,10 @@
+# javascript/clean/index-DVt3E1Ef.js
+encoding/json/decode
+encoding/json/encode
+evasion/int_to_char
+exec/cmd
+fs/mount
+net/download
+ref/site/url
+ref/words/password
+techniques/code_eval

test_data/javascript/clean/sw.bundle.js.simple

@@ -0,0 +1,14 @@
+# javascript/clean/sw.bundle.js
+archives/zip
+encoding/base64
+encoding/json/decode
+encoding/json/encode
+evasion/int_to_char
+fd/read
+fd/write
+kernel/platform
+net/upload
+net/url
+obfuscation/js/high_entropy
+ref/site/url
+ref/words/password

test_data/linux/clean/api.json.simple

@@ -0,0 +1,29 @@
+# linux/clean/api.json
+archives/zip
+combo/recon/system_network
+encoding/json/decode
+encoding/json/encode
+env/USER
+fs/file/delete/forcibly
+net/download
+net/http/auth
+net/http/cookies
+net/http/form/upload
+net/http/post
+net/http/request
+net/socket/listen
+net/socket/send
+net/socks5
+net/upload
+net/url
+net/url/encode
+net/websocket
+ref/daemon
+ref/ip_port
+ref/path/tmp
+ref/site/url
+ref/words/agent
+ref/words/intercept
+ref/words/password
+ref/words/server_address
+techniques/code_eval

test_data/python/clean/playwright/async_api/_generated.py.simple

@@ -0,0 +1,22 @@
+# python/clean/playwright/async_api/_generated.py
+archives/zip
+combo/recon/system_network
+encoding/json/decode
+fs/file/delete/forcibly
+net/download
+net/http/cookies
+net/http/form/upload
+net/http/post
+net/http/request
+net/socket/listen
+net/socket/send
+net/upload
+net/url
+net/url/encode
+net/websocket
+ref/path/tmp
+ref/site/url
+ref/words/agent
+ref/words/intercept
+ref/words/password
+ref/words/server_address

test_data/python/clean/playwright/sync_api/_generated.py.simple

@@ -0,0 +1,22 @@
+# python/clean/playwright/sync_api/_generated.py
+archives/zip
+combo/recon/system_network
+encoding/json/decode
+fs/file/delete/forcibly
+net/download
+net/http/cookies
+net/http/form/upload
+net/http/post
+net/http/request
+net/socket/listen
+net/socket/send
+net/upload
+net/url
+net/url/encode
+net/websocket
+ref/path/tmp
+ref/site/url
+ref/words/agent
+ref/words/intercept
+ref/words/password
+ref/words/server_address

test_data/windows/clean/PrintDeps.exe.simple

@@ -0,0 +1,3 @@
+# windows/clean/PrintDeps.exe
+data/emdedded/app/manifest
+evasion/anti/debugger