Skip to content

Commit df12068

Browse files
tstrombergtstromberg
committed
Omit empty fields from JSON/YAML output
1 parent b97c1af commit df12068

11 files changed

+1368
-489
lines changed

‎pkg/bincapz/report.go‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -22,29 +22,29 @@ var riskLevels = map[int]string{
2222
}
2323

2424
type Behavior struct {
25-
Description string `json:",omitempty" yaml:",omitempty"`
26-
Strings []string
25+
Description string `json:",omitempty" yaml:",omitempty"`
26+
Strings []string `json:",omitempty" yaml:",omitempty"`
2727
RiskScore int
28-
RiskLevel string
29-
RuleAuthor string
30-
RuleLicense string
28+
RiskLevel string `json:",omitempty" yaml:",omitempty"`
29+
RuleAuthor string `json:",omitempty" yaml:",omitempty"`
30+
RuleLicense string `json:",omitempty" yaml:",omitempty"`
3131
}
3232

3333
type FileReport struct {
3434
// compiler -> x
35-
Error string
36-
Skipped string
37-
Meta map[string]string
38-
Syscalls []string
39-
Pledge []string
40-
Capabilities []string
41-
Behaviors map[string]Behavior
42-
FilteredBehaviors int `json:",omitempty" yaml:",omitempty"`
35+
Error string `json:",omitempty" yaml:",omitempty"`
36+
Skipped string `json:",omitempty" yaml:",omitempty"`
37+
Meta map[string]string `json:",omitempty" yaml:",omitempty"`
38+
Syscalls []string `json:",omitempty" yaml:",omitempty"`
39+
Pledge []string `json:",omitempty" yaml:",omitempty"`
40+
Capabilities []string `json:",omitempty" yaml:",omitempty"`
41+
Behaviors map[string]Behavior `json:",omitempty" yaml:",omitempty"`
42+
FilteredBehaviors int `json:",omitempty" yaml:",omitempty"`
4343
}
4444

4545
type Report struct {
4646
Files map[string]FileReport
47-
Filter string
47+
Filter string `json:",omitempty" yaml:",omitempty"`
4848
}
4949

5050
// yaraForge has some very very long rule names

‎testdata/Linux/bpfdoor_2022.x86_64.json‎

Lines changed: 135 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,15 @@
11
{
22
"Files": {
3-
"bpfdoor_2022.x86_64": {
4-
"Meta": {
5-
"compiler": "gcc"
6-
},
3+
"./Linux/bpfdoor_2022.x86_64": {
74
"Syscalls": [
85
"accept",
96
"chroot",
7+
"connect",
108
"execve",
11-
"getpid",
12-
"getuid",
13-
"ioctl",
14-
"prctl",
9+
"fork",
10+
"select",
1511
"sendmsg",
1612
"sendto",
17-
"setsid",
18-
"setsockopt",
1913
"unlink",
2014
"utimes",
2115
"vhangup"
@@ -24,41 +18,134 @@
2418
"exec",
2519
"fattr",
2620
"inet",
27-
"proc",
28-
"rpath",
21+
"stdio",
2922
"wpath"
3023
],
31-
"Capabilities": [],
3224
"Behaviors": {
25+
"3P/elastic/linux/bpfdoor": {
26+
"Description": "Detects Linux Trojan Bpfdoor (Linux.Trojan.BPFDoor)",
27+
"Strings": [
28+
"$a1"
29+
],
30+
"RiskScore": 4,
31+
"RiskLevel": "CRIT",
32+
"RuleAuthor": "Elastic Security",
33+
"RuleLicense": "https://github.com/elastic/protections-artifacts//blob/6d54ae289b290b1d42a7717569483f6ce907200a/LICENSE.txt"
34+
},
35+
"3P/signature_base/redmenshen/bpfdoor": {
36+
"Description": "Detects BPFDoor implants used by Chinese actor Red Menshen",
37+
"Strings": [
38+
"$op1",
39+
"$op2",
40+
"$op3",
41+
"$op4"
42+
],
43+
"RiskScore": 4,
44+
"RiskLevel": "CRIT",
45+
"RuleAuthor": "Florian Roth (Nextron Systems)",
46+
"RuleLicense": "https://github.com/Neo23x0/signature-base/blob/cd7651d2ccf4158a35a8d1cc0441928f7d92818f/LICENSE"
47+
},
48+
"combo/backdoor/linux/listen_terminal_exec": {
49+
"Description": "Listens, provides a terminal, runs program",
50+
"Strings": [
51+
"/dev/ptmx",
52+
"execve",
53+
"grantpt",
54+
"listen"
55+
],
56+
"RiskScore": 3,
57+
"RiskLevel": "HIGH"
58+
},
59+
"combo/backdoor/linux/multiple_sys_commands": {
60+
"Description": "multiple sys commands",
61+
"Strings": [
62+
"auditd",
63+
"systemd/systemd"
64+
],
65+
"RiskScore": 3,
66+
"RiskLevel": "HIGH"
67+
},
3368
"device/pseudo_terminal": {
3469
"Description": "pseudo-terminal access functions",
3570
"Strings": [
3671
"grantpt",
3772
"ptsname",
3873
"unlockpt"
3974
],
40-
"Risk": 1
75+
"RiskScore": 2,
76+
"RiskLevel": "MED"
4177
},
4278
"exec/program": {
43-
"Description": "calls other programs",
79+
"Description": "executes another program",
4480
"Strings": [
4581
"execve"
4682
],
47-
"Risk": 1
83+
"RiskScore": 2,
84+
"RiskLevel": "MED"
4885
},
4986
"exec/program/background": {
5087
"Description": "Waits for a process to exit",
5188
"Strings": [
5289
"waitpid"
5390
],
54-
"Risk": 1
91+
"RiskScore": 1,
92+
"RiskLevel": "LOW"
93+
},
94+
"exec/shell_command": {
95+
"Description": "execute a shell command",
96+
"Strings": [
97+
"system"
98+
],
99+
"RiskScore": 2,
100+
"RiskLevel": "MED"
101+
},
102+
"fd/multiplex": {
103+
"Description": "monitor multiple file descriptors",
104+
"Strings": [
105+
"select"
106+
],
107+
"RiskScore": 1,
108+
"RiskLevel": "LOW"
55109
},
56110
"fs/file/delete": {
57111
"Description": "deletes files",
58112
"Strings": [
59113
"unlink"
60114
],
61-
"Risk": 1
115+
"RiskScore": 1,
116+
"RiskLevel": "LOW"
117+
},
118+
"fs/file/times/set": {
119+
"Description": "change file last access and modification times",
120+
"Strings": [
121+
"utimes"
122+
],
123+
"RiskScore": 2,
124+
"RiskLevel": "MED"
125+
},
126+
"net/ip/byte/order": {
127+
"Description": "convert values between host and network byte order",
128+
"Strings": [
129+
"htons"
130+
],
131+
"RiskScore": 2,
132+
"RiskLevel": "MED"
133+
},
134+
"net/ip/string": {
135+
"Description": "converts IP address from byte to string",
136+
"Strings": [
137+
"inet_ntoa"
138+
],
139+
"RiskScore": 2,
140+
"RiskLevel": "MED"
141+
},
142+
"net/socket/connect": {
143+
"Description": "initiate a connection on a socket",
144+
"Strings": [
145+
"connect"
146+
],
147+
"RiskScore": 1,
148+
"RiskLevel": "LOW"
62149
},
63150
"net/socket/listen": {
64151
"Description": "listen on a socket",
@@ -67,60 +154,74 @@
67154
"listen",
68155
"socket"
69156
],
70-
"Risk": 1
157+
"RiskScore": 1,
158+
"RiskLevel": "LOW"
71159
},
72160
"net/socket/receive": {
73161
"Description": "receive a message from a socket",
74162
"Strings": [
75163
"recvfrom"
76164
],
77-
"Risk": 1
165+
"RiskScore": 1,
166+
"RiskLevel": "LOW"
78167
},
79168
"net/socket/send": {
80169
"Description": "send a message to a socket",
81170
"Strings": [
82171
"sendto"
83172
],
84-
"Risk": 1
173+
"RiskScore": 1,
174+
"RiskLevel": "LOW"
175+
},
176+
"process/create": {
177+
"Description": "Create a new child process using fork",
178+
"Strings": [
179+
"fork"
180+
],
181+
"RiskScore": 1,
182+
"RiskLevel": "LOW"
85183
},
86-
"proc/chroot": {
184+
"process/current/chroot": {
87185
"Description": "change the location of root for the process",
88186
"Strings": [
89187
"chroot"
90188
],
91-
"Risk": 1
189+
"RiskScore": 1,
190+
"RiskLevel": "LOW"
92191
},
93192
"random/insecure": {
94193
"Description": "generate random numbers insecurely",
95194
"Strings": [
96195
"srand"
97196
],
98-
"Risk": 1
197+
"RiskScore": 1,
198+
"RiskLevel": "LOW"
99199
},
100200
"ref/path/usr/sbin": {
101201
"Description": "References paths within /usr/sbin",
102202
"Strings": [
103203
"/usr/sbin/console-kit-daemon"
104204
],
105-
"Risk": 1
205+
"RiskScore": 1,
206+
"RiskLevel": "LOW"
106207
},
107-
"service/daemon": {
108-
"Description": "Run as a background daemon",
208+
"ref/program/ancient_gcc": {
209+
"Description": "built by archaic gcc version",
109210
"Strings": [
110-
"daemon"
211+
"GCC: (GNU) 4.4.7"
111212
],
112-
"Risk": 1
213+
"RiskScore": 3,
214+
"RiskLevel": "HIGH"
113215
},
114216
"tty/vhangup": {
115217
"Description": "virtually hangup the current terminal",
116218
"Strings": [
117219
"vhangup"
118220
],
119-
"Risk": 1
221+
"RiskScore": 1,
222+
"RiskLevel": "LOW"
120223
}
121-
},
122-
"FilteredBehaviors": 8
224+
}
123225
}
124-
},
125-
"Filter": "harmless"
226+
}
126227
}

0 commit comments

Comments
 (0)