Address false positives seen with argocd, grafana, jupyterhub, and reflex #475
Conversation
Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>
egibs
force-pushed
the
20241001-false-positive-fixes
branch
from
5dac973 to
a3d417f
Compare
Signed-off-by: Evan Gibler <20933572+egibs@users.noreply.github.com>
Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>
|
The changes in |
| $a_const = "const " | ||
| $a_function = "function(" | ||
| $a_return = "{return" | ||
|
|
There was a problem hiding this comment.
also mark this as a "high"
There was a problem hiding this comment.
If we move these to high, I can remove the exclusions. That would be a lot cleaner.
There was a problem hiding this comment.
Works for me. In my mind, "CRITICAL" rules should never be broad enough for false positives to easily happen.
rules/combo/degrader/edr_killer.yara
Outdated
| @@ -28,8 +30,10 @@ rule win_kill_proc : critical { | |||
| $debug_uhf = "UnhandledExceptionFilter" | |||
| $kill_gmh = "GetModuleHandle" | |||
| $kill_tp = "TerminateProcess" | |||
|
|
|||
| $not_printdeps_exe = {55 73 61 67 65 3A 0A 20 20 50 72 69 6E 74 44 65 70 73 20 46 49 4C 45 2E 2E 2E 00 00 00 00 00 56 65 72 73 69 6F 6E 3A 20 72 00 00 25 70 00 00 65 45 00 00 70 50} | |||
There was a problem hiding this comment.
Also change criticality to high
rules/combo/stealer/browser.yara
Outdated
| @@ -60,6 +60,8 @@ rule multiple_browser_refs : critical { | |||
| $not_ff_js = "Firefox can even throw an error" | |||
| $not_generated_comment = "// This file is generated" | |||
| $not_generated_file = "/utils/generate_types/index.js" | |||
| $not_microsoft = "Copyright (c) Microsoft Corporation." | |||
There was a problem hiding this comment.
Also change criticality to high
rules/combo/stealer/crypto.yara
Outdated
| condition: | ||
| filesize < 50KB and $url and $POST and any of ($pk*) | ||
| filesize < 50KB and $url and $POST and any of ($pk*) and none of ($not_*) |
There was a problem hiding this comment.
Also change criticality to high
| condition: | ||
| filesize < 256KB and #const > 32 and #function > 48 and #return > 64 | ||
| filesize < 256KB and #const > 32 and #function > 48 and #return > 64 and none of ($not_*) |
There was a problem hiding this comment.
Change criticality to medium
rules/obfuscation/js/parseInt.yara
Outdated
| condition: | ||
| filesize < 256KB and #const > 16 and #function > 32 and #parseInt > 8 and #return > 32 | ||
| filesize < 256KB and #const > 16 and #function > 32 and #parseInt > 8 and #return > 32 and none of ($not_*) |
There was a problem hiding this comment.
Change criticality to high
Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>
egibs
changed the title
This PR addresses the [critical] false positives seen in these PRs:
The difficult exclusion was with the
PrintDeps.exefile, so I opted to exclude this string:Depends on chainguard-dev/malcontent-samples#8