Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Resolve datadog-agent kworker false positives #300

Merged
merged 13 commits into from
Jul 1, 2024
Merged

Resolve datadog-agent kworker false positives #300

Changes from 2 commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
a1b5c67
Resolve datadog-agent kworker false positives
egibs Jun 29, 2024
577c4b0
Better handling of ignore_ref
egibs Jun 30, 2024
413f45f
Update rules/evasion/fake-process-name.yara
egibs Jul 1, 2024
a38dcc6
Merge branch 'main' into resolve-dd-agent-kworker-false-positive
egibs Jul 1, 2024
54c35ea
Update rules/evasion/fake-process-name.yara
egibs Jul 1, 2024
9c6e27a
Merge branch 'main' into resolve-dd-agent-kworker-false-positive
egibs Jul 1, 2024
5360cf3
Merge branch 'main' into resolve-dd-agent-kworker-false-positive
egibs Jul 1, 2024
bc04d85
Add more precise DataDog process-agent kworker references
egibs Jul 1, 2024
6e1ab28
More specificity
egibs Jul 1, 2024
e00d4a8
Consolidate ignores
egibs Jul 1, 2024
d34ecb7
Ignore DataDog strings
egibs Jul 1, 2024
ca4eff3
Merge branch 'main' into resolve-dd-agent-kworker-false-positive
tstromberg Jul 1, 2024
f30bdef
Use an expression to cover both
egibs Jul 1, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions rules/evasion/fake-process-name.yara
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@

rule fake_kworker_val : critical {
meta:
description = "Pretends to be a kworker kernel thread"
Expand All @@ -7,10 +6,11 @@ rule fake_kworker_val : critical {
hash_2023_Unix_Downloader_Rocke_6107 = "61075056b46d001e2e08f7e5de3fb9bfa2aabf8fb948c41c62666fd4fab1040f"
strings:
$kworker = /\[{0,1}kworker\/[\d:\]]{1,5}/
$kworker2 = "kworker" fullword
$kworker2 = /\b[Kk]worker\b/
egibs marked this conversation as resolved.
Show resolved Hide resolved
egibs marked this conversation as resolved.
Show resolved Hide resolved
$kworker3 = "[kworker"
$ignore_ref = /\w+\_kworker/
egibs marked this conversation as resolved.
Show resolved Hide resolved
egibs marked this conversation as resolved.
Show resolved Hide resolved
condition:
any of them
any of ($kworker*) and not $ignore_ref
}

rule fake_syslogd : critical {
Expand Down