More /dev/tcp rule tweaks for GitLab healthcheck script (#372)

* More /dev/tcp rule tweaks for GitLab healthcheck script Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> * Refresh test data Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> --------- Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>
chainguard-dev · Jul 19, 2024 · a038cc6 · a038cc6
1 parent 47737ba
commit a038cc6
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 4 deletions.
diff --git a/rules/shell/bash_dev_tcp.yara b/rules/shell/bash_dev_tcp.yara
@@ -8,8 +8,11 @@ rule bash_dev_tcp : high exfil {
   strings:
     $ref = "/dev/tcp"
     $posixly_correct = "POSIXLY_CORRECT"
+    $not_comment = "# Check that both our processes are running on their tcp port"
+    $not_get = /GET \/ HTTP\/1.1\n{1,2} >/
+    $not_localhost_8080 = "/dev/tcp/127.0.0.1/8080"
   condition:
-    $ref and not $posixly_correct
+    $ref and not $posixly_correct and none of ($not*)
 }
 
 
@@ -19,8 +22,8 @@ rule bash_dev_tcp_hardcoded_ip : critical {
   strings:
     $dev_tcp = /\/dev\/tcp\/[\w\.]{8,16}\/\d{1,6}/
     $not_comment = "# Check that both our processes are running on their tcp port"
-    $not_get = "GET / HTTP/1.1 >"
+    $not_get = /GET \/ HTTP\/1.1\n{1,2} >/
     $not_localhost_8080 = "/dev/tcp/127.0.0.1/8080"
   condition:
-	  $dev_tcp and none of ($not_*)
+	  $dev_tcp and none of ($not*)
 }
diff --git a/samples/Linux/clean/healthcheck.simple b/samples/Linux/clean/healthcheck.simple
@@ -1,5 +1,4 @@
 # Linux/clean/healthcheck
 net/http/request
 ref/path/dev
-shell/bash_dev_tcp
 shell/exec