2025/08/04 false positive reduction (#1072)

egibs · web-flow · commit 7d28a97e3bb8 · 2025-08-04T15:34:50.000-05:00
Signed-off-by: egibs &lt;20933572+egibs@users.noreply.github.com&gt;
diff --git a/pkg/compile/compile.go b/pkg/compile/compile.go
@@ -38,6 +38,7 @@ var badRules = map[string]bool{
 	"DELIVRTO_SUSP_SVG_Foreignobject_Nov24":               true,
 	"CAPE_Eternalromance":                                 true,
 	"CAPE_Formhookb":                                      true,
+	"TELEKOM_SECURITY_Cn_Utf8_Windows_Terminal":           true,
 	// ThreatHunting Keywords (some duplicates)
 	"Adobe_XMP_Identifier":                       true,
 	"Antivirus_Signature_signature_keyword":      true,
@@ -72,7 +73,8 @@ var badRules = map[string]bool{
 	"malware_PlugX_config":   true,
 	"malware_shellcode_hash": true,
 	// bartblaze
-	"Rclone": true,
+	"Rclone":                        true,
+	"Extract_MachineKey_SharePoint": true,
 	// Rules that are incompatible with yara-x (unescaped braces in regex strings)
 	"RTF_Header_Obfuscation":    true,
 	"RTF_File_Malformed_Header": true,
diff --git a/pkg/report/report.go b/pkg/report/report.go
@@ -821,8 +821,7 @@ func handleOverrides(original, override []*malcontent.Behavior, minScore int, sc
 		// append every behavior so we can handle filtering correctly
 		if scan && quantityIncreasesRisk && b.RiskScore >= HIGH {
 			modified = append(modified, b)
-		}
-		if b.RiskScore >= minScore {
+		} else if !scan && b.RiskScore >= minScore {
 			modified = append(modified, b)
 		}
 	}
diff --git a/rules/anti-behavior/blocklist/user.yara b/rules/anti-behavior/blocklist/user.yara
@@ -37,6 +37,13 @@ rule common_username_block_list: high {
     $ = "test" fullword
     $ = "w0fjuOVmCcP5A" fullword
 
+    $not_gpt_tokenizer1 = "GPTTokenizer"
+    $not_gpt_tokenizer2 = "GPT-4"
+    $not_gpt_tokenizer3 = "const bpe = c0.concat();"
+    $not_gpt_tokenizer4 = "const bpe = c0.concat(c1);"
+    $not_gpt_tokenizer5 = "export default bpe;"
+    $not_vale           = "github.com/errata-ai/vale"
+
   condition:
-    12 of them
+    12 of them and none of ($not*)
 }
diff --git a/rules/anti-static/obfuscation/bitwise.yara b/rules/anti-static/obfuscation/bitwise.yara
@@ -138,7 +138,9 @@ rule unsigned_bitwise_math_excess: high {
     $left  = /[a-z]\>\>\>\d{1,3}/
     $right = /[a-z]\>\>\>\d{1,3}/
 
-    $not_webpack = "webpack-api-runtime.js" fullword
+    $not_elastic1 = "/*! Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one or more contributor license agreements."
+    $not_elastic2 = "* Licensed under the Elastic License 2.0; you may not use this file except in compliance with the Elastic License 2.0. */"
+    $not_webpack  = "webpack-api-runtime.js" fullword
 
   condition:
     filesize < 5MB and $function and $charAt and (#left > 50 or #right > 50) and none of ($not*)
diff --git a/rules/c2/addr/ip.yara b/rules/c2/addr/ip.yara
@@ -56,13 +56,15 @@ rule http_hardcoded_ip: high exfil {
     description = "hardcoded IP address within a URL"
 
   strings:
-    $ipv4         = /https*:\/\/([1-9][0-9]{1,2}\.){3}[1-9][0-9]{1,2}[:\/\w\-\?\.\=]{0,64}/
-    $not_metadata = "http://169.254.169.254"
-    $not_100      = "http://100.100.100"
-    $not_11       = "http://11.11.11"
-    $not_192      = "http://192.168"
-    $not_169      = "http://169.254"
-    $not_aria     = "http://210.104.33.10/ARIA/"
+    $ipv4             = /https*:\/\/([1-9][0-9]{1,2}\.){3}[1-9][0-9]{1,2}[:\/\w\-\?\.\=]{0,64}/
+    $not_metadata     = "http://169.254.169.254"
+    $not_100          = "http://100.100.100"
+    $not_11           = "http://11.11.11"
+    $not_192          = "http://192.168"
+    $not_169          = "http://169.254"
+    $not_aria         = "http://210.104.33.10/ARIA/"
+    $not_placeholder1 = "placeholder:\"e.g. https://192.168.99.200:443/api\""
+    $not_placeholder2 = "placeholder:\"e.g. http://138.68.74.142:7860\""
 
   condition:
     $ipv4 and none of ($not*)
diff --git a/rules/evasion/file/location/dev-shm.yara b/rules/evasion/file/location/dev-shm.yara
@@ -40,6 +40,7 @@ rule dev_shm_file: high linux {
     $not_yarn3         = "@yarnpkg"
     $not_yarn4         = "YARN_"
     $not_yarn5         = "b.mkdir(\"/dev/shm/tmp\")"
+    $not_libheif       = "EA.mkdir(\"/dev/shm\"),EA.mkdir(\"/dev/shm/tmp\")"
 
   condition:
     $ref and none of ($not*) and not dev_shm_mkstemp
diff --git a/rules/evasion/mimicry/fake-process.yara b/rules/evasion/mimicry/fake-process.yara
@@ -46,8 +46,10 @@ rule fake_bash: high {
   strings:
     $bash = "-bash" fullword
 
+    $not_kong_template = "name: {{ template \"kong.fullname\" . }}-bash-wait-for-postgres"
+
   condition:
-    filesize < 8KB and $bash
+    filesize < 8KB and $bash and none of ($not*)
 }
 
 rule fake_systemd: critical linux {
diff --git a/rules/evasion/rootkit/userspace.yara b/rules/evasion/rootkit/userspace.yara
@@ -58,6 +58,7 @@ rule readdir_dlsym_interceptor: high {
     $f_readlink_maybe_not_needed = "readlink"
     $f_proc                      = "/proc"
 
+    $not_j9   = "j9port_" fullword
     $not_sbcl = "SBCL_HOME" fullword
 
   condition:
diff --git a/rules/exec/remote_commands/code_eval.yara b/rules/exec/remote_commands/code_eval.yara
@@ -75,8 +75,11 @@ rule js_eval_obfuscated_fromChar: high {
     $eval = /[\s\{]eval\(/
     $ref  = /fromCharCode\(\w{0,16}\s{0,2}[\-\+\*\^]{0,2}\w{0,16}/
 
+    $not_elastic1 = "/*! Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one or more contributor license agreements."
+    $not_elastic2 = "* Licensed under the Elastic License 2.0; you may not use this file except in compliance with the Elastic License 2.0. */"
+
   condition:
-    filesize < 5MB and all of them and math.abs(@eval - @ref) > 384
+    filesize < 5MB and all of them and math.abs(@eval - @ref) > 384 and none of ($not*)
 }
 
 rule js_anonymous_function: medium {
diff --git a/rules/exfil/stealer/creds.yara b/rules/exfil/stealer/creds.yara
@@ -3,34 +3,39 @@ rule suspected_data_stealer: high {
     description = "suspected data stealer"
 
   strings:
-    $e_atomic        = "Atomic" fullword
-    $e_bitcoin       = "Bitcoin" fullword
-    $e_chromium      = "Chromium"
-    $e_chrome        = "Chrome" fullword
-    $e_firefox       = "Firefox"
-    $e_openvpn       = "OpenVPN"
-    $s_bookmarks     = "Bookmarks"
-    $s_history       = "History"
-    $s_binance       = "Binance"
-    $s_discord       = "Discord"
-    $s_electrum      = "Electrum"
-    $s_electrum2     = "/.elect"
-    $s_exodus        = "Exodus"
-    $s_exodus_ext    = "aholpfdial"
-    $s_crypto        = "cfgodnhcel"
-    $s_obs           = "obs-studio"
-    $s_pidgin        = "Pidgin"
-    $s_snowflake     = "Snowflake"
-    $s_telegram      = "Telegram"
-    $s_zcash         = "Zcash"
-    $s_zip           = "zip -r"
-    $s_login         = "Login Data"
-    $not_electron    = "ELECTRON_RUN_AS_NODE"
-    $not_chromium    = "RasterCHROMIUM"
-    $not_descriptive = "Binance Pay is a contactless"
+    $e_atomic           = "Atomic" fullword
+    $e_bitcoin          = "Bitcoin" fullword
+    $e_chromium         = "Chromium"
+    $e_chrome           = "Chrome" fullword
+    $e_firefox          = "Firefox"
+    $e_openvpn          = "OpenVPN"
+    $s_bookmarks        = "Bookmarks"
+    $s_history          = "History"
+    $s_binance          = "Binance"
+    $s_discord          = "Discord"
+    $s_electrum         = "Electrum"
+    $s_electrum2        = "/.elect"
+    $s_exodus           = "Exodus"
+    $s_exodus_ext       = "aholpfdial"
+    $s_crypto           = "cfgodnhcel"
+    $s_obs              = "obs-studio"
+    $s_pidgin           = "Pidgin"
+    $s_snowflake        = "Snowflake"
+    $s_telegram         = "Telegram"
+    $s_zcash            = "Zcash"
+    $s_zip              = "zip -r"
+    $s_login            = "Login Data"
+    $not_chromium       = "RasterCHROMIUM"
+    $not_descriptive    = "Binance Pay is a contactless"
+    $not_electron       = "ELECTRON_RUN_AS_NODE"
+    $not_gpt_tokenizer1 = "GPTTokenizer"
+    $not_gpt_tokenizer2 = "GPT-4"
+    $not_gpt_tokenizer3 = "const bpe = c0.concat();"
+    $not_gpt_tokenizer4 = "const bpe = c0.concat(c1);"
+    $not_gpt_tokenizer5 = "export default bpe;"
 
   condition:
-    (8 of them and none of ($not*)) or 5 of ($s*)
+    (8 of them or 5 of ($s*)) and none of ($not*)
 }
 
 rule steal_creds: high {
diff --git a/rules/false_positives/ansible.yara b/rules/false_positives/ansible.yara
@@ -0,0 +1,16 @@
+rule ansible_override: override {
+  meta:
+    description                    = "async_wrapper.ps1,become_wrapper.ps1"
+    pshome_casing                  = "medium"
+    ps_executionpolicy_bypass      = "medium"
+    powershell_encoded_command_val = "medium"
+    SMTPClient_Send_creds          = "medium"
+
+  strings:
+    $ansible = "# (c) 2025 Ansible Project"
+    $async   = "#AnsibleRequires -CSharpUtil Ansible._Async"
+    $become  = "#AnsibleRequires -CSharpUtil Ansible.Become"
+
+  condition:
+    $ansible and ($async or $become)
+}
diff --git a/rules/false_positives/fastfetch.yara b/rules/false_positives/fastfetch.yara
@@ -0,0 +1,12 @@
+rule fastfetch_override: override {
+  meta:
+    description     = "/usr/bin/fastfetch"
+    proc_d_cmdline  = "medium"
+    proc_d_exe_high = "medium"
+
+  strings:
+    $repo = "https://github.com/fastfetch-cli/fastfetch"
+
+  condition:
+    $repo
+}
diff --git a/rules/false_positives/kong.yara b/rules/false_positives/kong.yara
@@ -0,0 +1,11 @@
+rule kong_wait: override {
+  meta:
+    description = "wait-for-postgres-script.yaml"
+    bash_tcp    = "medium"
+
+  strings:
+    $bash = "bash -c \"9<>/dev/tcp/${KONG_PG_HOST}/${KONG_PG_PORT}\""
+
+  condition:
+    $bash
+}
diff --git a/rules/false_positives/nextcloud.yara b/rules/false_positives/nextcloud.yara
@@ -2,8 +2,11 @@ rule vimeo_psalm_md_php_override: override {
   meta:
     description                         = "Psalm MD files with PHP code excerpts"
     SIGNATURE_BASE_WEBSHELL_PHP_Dynamic = "harmless"
+    remote_eval_close                   = "harmless"
 
   strings:
+    $ = "# Tainted Eval"
+    $ = "Passing untrusted user input to `eval` calls is dangerous, as it allows arbitrary data to be executed on your server."
     $ = "Emitted when calling a function on a non-callable variable"
     $ = "Emitted when calling a function on a value whose type Psalm cannot infer."
     $ = "Emitted when trying to use `null` as a `callable`"
diff --git a/rules/false_positives/parseable.yara b/rules/false_positives/parseable.yara
@@ -0,0 +1,12 @@
+rule public_webhook: override {
+  meta:
+    description                                                          = "/usr/bin/parseable"
+    DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_References_Publicserviceinterface = "medium"
+
+  strings:
+    $parseable = "parseable"
+    $test      = "\"endpoint\":\"https://webhook.site/8e1f26bd-2f5b-47a2-9d0b-3b3dabb30710\",\"name\":\"Test Webhook\""
+
+  condition:
+    $parseable and $test
+}
diff --git a/rules/false_positives/sqlmap.yara b/rules/false_positives/sqlmap.yara
@@ -3,12 +3,16 @@ rule sqlmap_override: override {
     description                                 = "metasploit.py"
     SIGNATURE_BASE_HKTL_Sqlmap                  = "high"
     SIGNATURE_BASE_Hacktool_Strings_P0Wnedshell = "high"
+    iplookup_website                            = "medium"
+    office_crypt_archive                        = "harmless"
+    backdoor_caps                               = "medium"
 
   strings:
     $c_sqlmap1 = "Copyright (c) 2006-2025 sqlmap developers (https://sqlmap.org/)"
     $c_sqlmap2 = "Visit 'https://github.com/sqlmapproject/sqlmap/#installation' for further details"
     $f_sqlmap3 = /SqlmapBaseException|SqlmapDataException|SqlmapFilePathException|SqlmapShellQuitException|SqlmapSilentQuitException|SqlmapUserQuitException/
     $f_sqlmap4 = "if \"sqlmap.sqlmap\" in sys.modules"
+    $f_sqlmap5 = "# Leaving (dirty) possibility to change values from here (e.g. `export SQLMAP__MAX_NUMBER_OF_THREADS=20`)"
 
   condition:
     any of ($c*) and any of ($f*)
diff --git a/rules/fs/proc/pid-inspector.yara b/rules/fs/proc/pid-inspector.yara
@@ -20,16 +20,18 @@ rule pid_inspector_high: high {
     description = "accesses unusual process information"
 
   strings:
-    $proc_exe            = /\/proc\/[\%\@]\w{1,3}\/exe/
-    $proc_cmdline        = /\/proc\/[\%\@]\w{1,3}\/cmdline/
-    $proc_loginuid       = /\/proc\/[\%\@]\w{1,3}\/loginuid/
-    $proc_comm           = /\/proc\/[\%\@]\w{1,3}\/comm/
-    $proc_cgroup         = /\/proc\/[\%\@]\w{1,3}\/cgroup/
-    $proc_auxv           = /\/proc\/[\%\@]\w{1,3}\/auxv/
-    $proc_uid_map        = /\/proc\/[\%\@]\w{1,3}\/uid_map/
-    $not_network_manager = "org.freedesktop.NetworkManager"
-    $not_systemd         = "SYSTEMD_MACHINE_ID_PATH"
-    $not_cgroups         = "/proc/cgroups"
+    $proc_exe              = /\/proc\/[\%\@]\w{1,3}\/exe/
+    $proc_cmdline          = /\/proc\/[\%\@]\w{1,3}\/cmdline/
+    $proc_loginuid         = /\/proc\/[\%\@]\w{1,3}\/loginuid/
+    $proc_comm             = /\/proc\/[\%\@]\w{1,3}\/comm/
+    $proc_cgroup           = /\/proc\/[\%\@]\w{1,3}\/cgroup/
+    $proc_auxv             = /\/proc\/[\%\@]\w{1,3}\/auxv/
+    $proc_uid_map          = /\/proc\/[\%\@]\w{1,3}\/uid_map/
+    $not_network_manager   = "org.freedesktop.NetworkManager"
+    $not_systemd           = "SYSTEMD_MACHINE_ID_PATH"
+    $not_cgroups           = "/proc/cgroups"
+    $not_duplicate_cmdline = "/proc/%d/cmdline"  // handled via proc_d_cmdline
+    $not_duplicate_exe     = "/proc/%d/exe"  // handled via proc_d_exe
 
   condition:
     filesize < 104857600 and 3 of ($proc*) and none of ($not*)
diff --git a/rules/impact/cryptojacking/competitive.yara b/rules/impact/cryptojacking/competitive.yara
@@ -13,6 +13,7 @@ rule killer_miner_panchansminingisland: critical {
     $ = "updater" fullword
 
     $not_pypi_index = "testpack-id-lb001"
+    $not_vale       = "github.com/errata-ai/vale"
 
   condition:
     filesize < 120MB and 6 of them and none of ($not*)
diff --git a/rules/impact/exploit/exploit.yara b/rules/impact/exploit/exploit.yara
@@ -42,10 +42,13 @@ rule explot: high {
     description = "References 'explot'"
 
   strings:
-    $ref = "explot" fullword
+    $ref = "explot" ascii fullword
+
+    $not1 = { AD }  // soft hyphen
+    $not2 = { 20 02 }  // Nko letter N
 
   condition:
-    any of them
+    any of them and none of ($not*)
 }
 
 rule Exploit: medium {
diff --git a/rules/net/download/fetch.yara b/rules/net/download/fetch.yara
@@ -177,11 +177,13 @@ rule high_fetch_command_val: high {
     $not_continue                 = "--continue-at"
     $not_pciid                    = "https://pci-ids.ucw.cz"
 
-    $x_chmod    = "chmod" fullword
-    $x_Chmod    = "Chmod" fullword
-    $x_exe      = ".exe"
-    $x_rename   = "rename"
-    $x_rundll32 = "rundll32"
+    $x_chmod      = "chmod" fullword
+    $x_Chmod      = "Chmod" fullword
+    $not_elastic1 = "/*! Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one or more contributor license agreements."
+    $not_elastic2 = "* Licensed under the Elastic License 2.0; you may not use this file except in compliance with the Elastic License 2.0. */"
+    $x_exe        = ".exe"
+    $x_rename     = "rename"
+    $x_rundll32   = "rundll32"
 
   condition:
     filesize < 1MB and any of ($c*) and any of ($x*) and none of ($not*)
diff --git a/rules/net/ip/host_port.yara b/rules/net/ip/host_port.yara
@@ -80,6 +80,7 @@ rule hardcoded_host_port_over_10k: high {
     $not_slash_test           = "/test" fullword
     $not_test_message         = "test_message"
     $not_unit_test            = "unit test"
+    $not_example_registry     = "registry.com:5000"
 
   condition:
     any of ($h*) and none of ($not*)
diff --git a/rules/persist/cron/tab.yara b/rules/persist/cron/tab.yara
@@ -52,6 +52,10 @@ rule crontab_entry: high {
     $not_day_of_week  = "dayOfWeek"
     $not_day_of_month = "dayOfMonth"
 
+    $not_wolfi1 = "# As wolfi-baselayout does provide /var/spool/cron already, and we can not create this"
+    $not_wolfi2 = "# directory in the package, we need to create the cron file in the post-install scriptlet."
+    $not_wolfi3 = "# Since scriptlets don't run in apko, this is for the `apk add` command only."
+
   condition:
     filesize < 6KB and $crontab and any of ($repeat*) and none of ($not*)
 }

Original file line number	Diff line number	Diff line change
`@@ -821,8 +821,7 @@ func handleOverrides(original, override []*malcontent.Behavior, minScore int, sc`
`821`	`821`	`// append every behavior so we can handle filtering correctly`
`822`	`822`	`if scan && quantityIncreasesRisk && b.RiskScore >= HIGH {`
`823`	`823`	`modified = append(modified, b)`
`824`		`- }`
`825`		`- if b.RiskScore >= minScore {`
	`824`	`+ } else if !scan && b.RiskScore >= minScore {`
`826`	`825`	`modified = append(modified, b)`
`827`	`826`	`}`
`828`	`827`	`}`