Skip to content

Commit a24e323

Browse files
egibsegibs
authored
chore: fix or suppress rule warnings (#1260)
Signed-off-by: egibs <[email protected]>
1 parent 2bf1d18 commit a24e323

File tree

5 files changed

+25
-20
lines changed

5 files changed

+25
-20
lines changed

‎rules/anti-static/elf/header.yara‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ rule single_load_rwe: critical {
1010
author = "Tenable"
1111

1212
condition:
13-
elf.number_of_segments == 1 and elf.segments[0].type == elf.PT_LOAD and elf.segments[0].flags == elf.PF_R | elf.PF_W | elf.PF_X
13+
elf.number_of_segments == 1 and elf.segments[0].type == elf.PT_LOAD and elf.segments[0].flags == elf.PF_R | elf.PF_W | elf.PF_X // suppress: deprecated_field
1414
}
1515

1616
rule fake_section_headers_conflicting_entry_point_address: critical {
@@ -22,7 +22,7 @@ rule fake_section_headers_conflicting_entry_point_address: critical {
2222
author = "Tenable"
2323

2424
condition:
25-
elf.type == elf.ET_EXEC and elf.entry_point < filesize and elf.number_of_segments > 0 and elf.number_of_sections > 0 and not (for any i in (0..elf.number_of_segments): ((elf.segments[i].offset <= elf.entry_point) and ((elf.segments[i].offset + elf.segments[i].file_size) >= elf.entry_point) and for any j in (0..elf.number_of_sections): (elf.sections[j].offset <= elf.entry_point and ((elf.sections[j].offset + elf.sections[j].size) >= elf.entry_point) and (elf.segments[i].virtual_address + (elf.entry_point - elf.segments[i].offset)) == (elf.sections[j].address + (elf.entry_point - elf.sections[j].offset)))))
25+
elf.type == elf.ET_EXEC and elf.entry_point < filesize and elf.number_of_segments > 0 and elf.number_of_sections > 0 and not (for any i in (0..elf.number_of_segments): ((elf.segments[i].offset <= elf.entry_point) and ((elf.segments[i].offset + elf.segments[i].file_size) >= elf.entry_point) and for any j in (0..elf.number_of_sections): (elf.sections[j].offset <= elf.entry_point and ((elf.sections[j].offset + elf.sections[j].size) >= elf.entry_point) and (elf.segments[i].virtual_address + (elf.entry_point - elf.segments[i].offset)) == (elf.sections[j].address + (elf.entry_point - elf.sections[j].offset))))) // suppress: deprecated_field
2626
}
2727

2828
rule fake_dynamic_symbols: critical {
@@ -33,7 +33,7 @@ rule fake_dynamic_symbols: critical {
3333
author = "Tenable"
3434

3535
condition:
36-
elf.type == elf.ET_EXEC and elf.entry_point < filesize and elf.number_of_sections > 0 and elf.dynamic_section_entries > 0 and for any i in (0..elf.dynamic_section_entries): (elf.dynamic[i].type == elf.DT_SYMTAB and not (for any j in (0..elf.number_of_sections): (elf.sections[j].type == elf.SHT_DYNSYM and for any k in (0..elf.number_of_segments): ((elf.segments[k].virtual_address <= elf.dynamic[i].val) and ((elf.segments[k].virtual_address + elf.segments[k].file_size) >= elf.dynamic[i].val) and (elf.segments[k].offset + (elf.dynamic[i].val - elf.segments[k].virtual_address)) == elf.sections[j].offset))))
36+
elf.type == elf.ET_EXEC and elf.entry_point < filesize and elf.number_of_sections > 0 and elf.dynamic_section_entries > 0 and for any i in (0..elf.dynamic_section_entries): (elf.dynamic[i].type == elf.DT_SYMTAB and not (for any j in (0..elf.number_of_sections): (elf.sections[j].type == elf.SHT_DYNSYM and for any k in (0..elf.number_of_segments): ((elf.segments[k].virtual_address <= elf.dynamic[i].val) and ((elf.segments[k].virtual_address + elf.segments[k].file_size) >= elf.dynamic[i].val) and (elf.segments[k].offset + (elf.dynamic[i].val - elf.segments[k].virtual_address)) == elf.sections[j].offset)))) // suppress: deprecated_field
3737
}
3838

3939
rule high_entropy_header: high {

‎rules/anti-static/obfuscation/math.yara‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,14 +56,18 @@ rule sketchy_math_conversions: medium {
5656
$xor1 = /\d{2,16}\^\w{1,8}/
5757
$xor2 = /\w{1,8}\^\d{2,16}/
5858
59-
$complex_math = /[\(\[][\w\d\s\+\-\*\/\^]{10,50}[\)\]]/
59+
$complex_math_add = /[\(\[][\w\d\s\+\-\*\/\^]+\+[\w\d\s\+\-\*\/\^]+[\)\]]/
60+
$complex_math_sub = /[\(\[][\w\d\s\+\-\*\/\^]+\-[\w\d\s\+\-\*\/\^]+[\)\]]/
61+
$complex_math_mul = /[\(\[][\w\d\s\+\-\*\/\^]+\*[\w\d\s\+\-\*\/\^]+[\)\]]/
62+
$complex_math_div = /[\(\[][\w\d\s\+\-\*\/\^]+\/[\w\d\s\+\-\*\/\^]+[\)\]]/
63+
$complex_math_pow = /[\(\[][\w\d\s\+\-\*\/\^]+\^[\w\d\s\+\-\*\/\^]+[\)\]]/
6064
6165
condition:
6266
filesize < 1MB and
6367
($f_parseInt or $f_fromCharCode) and
6468
(
6569
(#math1 + #math2 > 5) or
6670
(#xor1 + #xor2 > 2) or
67-
#complex_math > 3
71+
any of ($complex_math*)
6872
)
6973
}

‎rules/anti-static/obfuscation/reverse.yara‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ rule js_function_reversal: high {
1717

1818
strings:
1919
$function_rev1 = "noitcnuf"
20-
$function_rev2 = { 6E 6F 69 74 63 6E 75 66 }
20+
$function_rev2 = { 6E 6F 69 74 63 6E 75 66 } // suppress: text_as_hex
2121
2222
$function_dots = /no\.?i\.?t\.?c\.?n\.?u\.?f/
2323
$return_rev = "nruter"

‎rules/malware/family/rustdoor.yara‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,10 @@ rule rustdoor: critical macos {
66
hash = "20b986b24d86d9a06746bdb0c25e21a24cb477acb36e7427a8c465c08d51c1e4"
77

88
strings:
9-
$botkill = { 62 6F 74 6B 69 6C 6C }
10-
$dialog = { 7A 69 70 74 61 73 6B }
11-
$upload = { 75 70 6C 6F 61 64 5F 66 69 6C 65 73 72 63 }
12-
$launchagents = { 4C 61 75 6E 63 68 41 67 65 6E 74 73 2E 70 6C 69 73 74 }
9+
$botkill = { 62 6F 74 6B 69 6C 6C } // suppress: text_as_hex
10+
$dialog = { 7A 69 70 74 61 73 6B } // suppress: text_as_hex
11+
$upload = { 75 70 6C 6F 61 64 5F 66 69 6C 65 73 72 63 } // suppress: text_as_hex
12+
$launchagents = { 4C 61 75 6E 63 68 41 67 65 6E 74 73 2E 70 6C 69 73 74 } // suppress: text_as_hex
1313
1414
condition:
1515
filesize > 1MB and filesize < 10MB and all of them
@@ -22,12 +22,12 @@ rule rustdoor_v2: critical macos {
2222
filetypes = "macho"
2323

2424
strings:
25-
$cfg_daemonize = { 64 61 65 6D 6F 6E 69 7A 65 }
26-
$cfg_cron = { 63 68 65 63 6B 5F 63 72 6F 6E 5F 61 73 6B 65 64 }
27-
$cfg_lock_in_cron = { 6C 6F 63 6B 5F 69 6E 5F 63 72 6F 6E }
28-
$cfg_lock_in_dock = { 6C 6F 63 6B 5F 69 6E 5F 64 6F 63 6B }
29-
$cfg_lock_in_launch = { 6C 6F 63 6B 5F 69 6E 5F 6C 61 75 6E 63 68 }
30-
$cfg_copy_files = { 63 6F 70 79 5F 66 69 6C 65 73 }
25+
$cfg_daemonize = { 64 61 65 6D 6F 6E 69 7A 65 } // suppress: text_as_hex
26+
$cfg_cron = { 63 68 65 63 6B 5F 63 72 6F 6E 5F 61 73 6B 65 64 } // suppress: text_as_hex
27+
$cfg_lock_in_cron = { 6C 6F 63 6B 5F 69 6E 5F 63 72 6F 6E } // suppress: text_as_hex
28+
$cfg_lock_in_dock = { 6C 6F 63 6B 5F 69 6E 5F 64 6F 63 6B } // suppress: text_as_hex
29+
$cfg_lock_in_launch = { 6C 6F 63 6B 5F 69 6E 5F 6C 61 75 6E 63 68 } // suppress: text_as_hex
30+
$cfg_copy_files = { 63 6F 70 79 5F 66 69 6C 65 73 } // suppress: text_as_hex
3131
3232
condition:
3333
filesize > 1MB and filesize < 10MB and 4 of them
@@ -40,10 +40,10 @@ rule rustdoor_maybe: high {
4040
filetypes = "macho"
4141

4242
strings:
43-
$botkill = { 62 6F 74 6B 69 6C 6C }
44-
$upload = { 75 70 6C 6F 61 64 }
45-
$sleep = { 73 6C 65 65 70 }
46-
$rmdir = { 72 6D 64 69 72 }
43+
$botkill = { 62 6F 74 6B 69 6C 6C } // suppress: text_as_hex
44+
$upload = { 75 70 6C 6F 61 64 } // suppress: text_as_hex
45+
$sleep = { 73 6C 65 65 70 } // suppress: text_as_hex
46+
$rmdir = { 72 6D 64 69 72 } // suppress: text_as_hex
4747
4848
condition:
4949
filesize > 1MB and filesize < 10MB and all of them

‎tests/npm/2024.nvmfix/config.js.simple‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
# npm/2024.nvmfix/config.js: high
22
anti-static/obfuscation/hex: medium
33
anti-static/obfuscation/js: high
4+
anti-static/obfuscation/math: medium
45
data/encoding/utf16: medium
56
process/create: medium

0 commit comments

Comments
 (0)