Address false positives for remaining public packages

pkg/action/testdata/scan_oci

@@ -10,6 +10,6 @@ ref/site/url
 net/download
 ref/site/url
 time/tzinfo
-# cgr.dev/chainguard/static ∴ /var/lib/db/sbom/wolfi-baselayout-20230201-r13.spdx.json
+# cgr.dev/chainguard/static ∴ /var/lib/db/sbom/wolfi-baselayout-20230201-r15.spdx.json
 net/download
 ref/site/url

pkg/compile/compile.go

@@ -20,12 +20,13 @@ var FS = rules.FS
 // badRules are noisy 3rd party rules to silently disable.
 var badRules = map[string]bool{
 	// YARAForge
-	"GCTI_Sliver_Implant_32Bit":                   true,
-	"GODMODERULES_IDDQD_God_Mode_Rule":            true,
-	"MALPEDIA_Win_Unidentified_107_Auto":          true,
-	"SIGNATURE_BASE_SUSP_PS1_JAB_Pattern_Jun22_1": true,
-	"ELCEEF_HTML_Smuggling_A":                     true,
-	"DELIVRTO_SUSP_HTML_WASM_Smuggling":           true,
+	"GCTI_Sliver_Implant_32Bit":                           true,
+	"GODMODERULES_IDDQD_God_Mode_Rule":                    true,
+	"MALPEDIA_Win_Unidentified_107_Auto":                  true,
+	"SIGNATURE_BASE_SUSP_PS1_JAB_Pattern_Jun22_1":         true,
+	"ELCEEF_HTML_Smuggling_A":                             true,
+	"DELIVRTO_SUSP_HTML_WASM_Smuggling":                   true,
+	"SIGNATURE_BASE_FVEY_Shadowbroker_Auct_Dez16_Strings": true,
 	// ThreatHunting Keywords (some duplicates)
 	"Adobe_XMP_Identifier":                       true,
 	"Antivirus_Signature_signature_keyword":      true,

rules/combo/backdoor/php.yara

@@ -19,9 +19,12 @@ rule php_possible_backdoor : critical {
     $f_exec = "exec("
     $eval = "eval"
     $not_aprutil = "APR-UTIL"
-    $not_syntax = "syntax file"
-    $not_reference = "stream_register_wrapper"
+    $not_highlight = "Please see https://github.com/highlightjs/highlight.js/pull/"
     $not_javadoc = "@param int"
+    $not_php_group = "Copyright (c) The PHP Group"
+    $not_reference = "stream_register_wrapper"
+    $not_syntax = "syntax file"
+    $not_workaround = "/* workaround for chrome bug "
   condition:
     filesize < 1048576 and $eval and 1 of ($php*) and 4 of ($f_*) and none of ($not*)
 }
@@ -85,6 +88,8 @@ rule php_urlvar_recon_exec : critical {
 
     $not_php = "PHP_VERSION_ID"
     $not_mongosh_php = { 3C 3F 70 68 70 00 00 00 01 0C 51 61 03 00 00 00 02 00 00 00 3F 3E }
+    $not_php_group = "Copyright (c) The PHP Group"
+    $not_workaround = "/* workaround for chrome bug "
   condition:
     any of ($p*) and any of ($e*) and any of ($f*) and any of ($x*) and none of ($not*)
 }
@@ -112,6 +117,7 @@ rule php_eval_gzinflate_base64_backdoor : critical {
 
     $not_php = "PHP_FLOAT_DIG" fullword
     $not_mongosh_php = { 3C 3F 70 68 70 00 00 00 01 0C 51 61 03 00 00 00 02 00 00 00 3F 3E }
+    $not_workaround = "/* workaround for chrome bug "
   condition:
     all of ($f*) and none of ($not*)
 }
@@ -141,12 +147,15 @@ rule php_base64_eval_uname : critical {
     hash_2023_0xShell_wesoori = "bab1040a9e569d7bf693ac907948a09323c5f7e7005012f7b75b5c1b2ced10ad"
     hash_2024_Deobfuscated_1n73ctionShell_abc00305dcfabe889507832e7385af937b94350d = "de1ef827bcd3100a259f29730cb06f7878220a7c02cee0ebfc9090753d2237a8"
   strings:
-    $php = "<?php"
-    $eval = "eval("
-    $uname = "_uname()"
-    $base64_decode = "base64_decode"
+    $f_php = "<?php"
+    $f_eval = "eval("
+    $f_uname = "_uname()"
+    $f_base64_decode = "base64_decode"
+
+    $not_php_group = "Copyright (c) The PHP Group"
+    $not_workaround = "/* workaround for chrome bug "
   condition:
-    all of them
+    all of ($f*) and none of ($not*)
 }
 
 rule php_post_system : medium {
@@ -162,6 +171,8 @@ rule php_post_system : medium {
     $system = "system("
 
     $not_mongosh_php = { 3C 3F 70 68 70 00 00 00 01 0C 51 61 03 00 00 00 02 00 00 00 3F 3E }
+    $not_php_group = "Copyright (c) The PHP Group"
+    $not_workaround = "/* workaround for chrome bug "
   condition:
     $php and any of ($method*) and $system and none of ($not*)
 }
@@ -192,8 +203,10 @@ rule php_system_manipulation : high {
     $fwrite = "fwrite("
     $posix_getpwuid = "posix_getpwuid("
     $symlink = "symlink("
+
+    $not_workaround = "/* workaround for chrome bug "
   condition:
-    $php and 80% of them
+    $php and 80% of them and none of ($not*)
 }
 
 rule php_system_hex : critical {

rules/combo/stealer/password.yara

@@ -15,7 +15,9 @@ rule password_finder_mimipenguin : critical {
     $extra_finder = /\bFinder\b/
     $extra_password = /\b[Pp]assword\b/
     $extra_password2 = /.[^\s]{0,32}-password/
-    $ignore_basic_auth_example = /\w{0,32}\:[Pp]assword/
+    $not_basic_auth_example = /\w{0,32}\:[Pp]assword/
+    $not_caddy = "//starting caddy process"
+    $not_datadog = /[Dd]ata[Dd]og/
   condition:
-    2 of ($base_*) and (any of ($extra_*) and none of ($ignore_*))
+    2 of ($base*) and (any of ($extra*) and none of ($not*))
 }

rules/evasion/decrypt-eval.yara

@@ -4,10 +4,12 @@ rule python_exec_eval_one_line : critical {
   meta:
     description = "Evaluates code from encrypted content on a single line via exec or eval"
   strings:
-    $eval_decrypt_one_line = /eval\s{0,32}\(.{0,32}decrypt/ ascii wide
-    $exec_decrypt_one_line = /exec\s{0,32}\(.{0,32}decrypt/ ascii wide
+    $f_eval_decrypt_one_line = /eval\s{0,32}\(.{0,32}decrypt/ ascii wide
+    $f_exec_decrypt_one_line = /exec\s{0,32}\(.{0,32}decrypt/ ascii wide
+    $not_opa = "constraintsdk_decision_eval"
+    $not_opa2 = " (DEPRECATED: %s)decryption"
   condition:
-    any of them
+    any of ($f*) and none of ($not*)
 }
 
 rule python_exec_near_enough_decrypt : high {

rules/evasion/fake-process-name.yara

@@ -9,9 +9,11 @@ rule fake_kworker_val : critical {
     $kworker2 = "kworker" fullword
     $kworker3 = "[kworker"
     // datadog process-agent
-    $ignore_datadog = /[Dd]ata[Dd]og/
+    $not_datadog = /[Dd]ata[Dd]og/
+    $not_datadog2 = /\*{0,1}is_kworker/
+    $not_datadog3 = /is_current_kworker_dying\({0,1}\){0,1}/
   condition:
-    any of ($kworker*) and not $ignore_datadog
+    any of ($kworker*) and none of ($not*)
 }
 
 rule fake_syslogd : critical {

rules/ref/words/ransomware-lvt.yara

@@ -48,6 +48,10 @@ rule lvt : critical {
     $bf = "WE WILL NOT BE ABLE"
     $bg = "ABLE TO RESTORE"
     $bh = "TO RESTORE THEM"
+
+    $not_sonar = "Copyright (C) 2008-2013 SonarSource"
+    $not_sonar2 = "mailto:contact AT sonarsource DOT com"
+    $not_sonar3 = "SonarQube is free software; you can redistribute it and/or"
   condition:
-    2 of them
+    2 of them and none of ($not*)
 }