Skip to content

fix(yara): detect multiline socket reverse shells #599

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
efegokdemir wants to merge 2 commits into
base: main
Choose a base branch
from
+124 −75
Open

fix(yara): detect multiline socket reverse shells #599

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ab857e4
fix(yara): detect multiline socket reverse shells
efegokdemir Sep 21, 2026
1a4adf2
fix: require shell evidence for socket signatures
efegokdemir Sep 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
162 changes: 87 additions & 75 deletions src/skillspector/yara_rules/malware.yar.b64
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,78 +12,90 @@ X3JldnNoZWxsICAgID0gL2Jhc2hccystaVxzKz4mXHMqXC9kZXZcL3RjcFwvLyBub2Nhc2UNCiAg
ICAgICAgJG5jX3NoZWxsICAgICAgICAgPSAvbmNccy4qLWVccypcL2JpblwvKGJhKT9zaC8gbm9j
YXNlDQogICAgICAgICRuY2F0X3NoZWxsICAgICAgID0gL25jYXRccy4qLWVccypcL2JpblwvKGJh
KT9zaC8gbm9jYXNlDQogICAgICAgICRweXRob25fc29ja2V0ICAgID0gL3NvY2tldFwuc29ja2V0
XCguKlNPQ0tfU1RSRUFNLipcLmNvbm5lY3RcKC8NCiAgICAgICAgJHBlcmxfc29ja2V0ICAgICAg
PSAvdXNlXHMrU29ja2V0Oy4qc29ja2V0XHMqXChccypTT0NLLw0KICAgICAgICAkcGhwX2Zzb2Nr
ICAgICAgICA9IC9mc29ja29wZW5ccypcKC4qZXhlY1xzKlwoLyBub2Nhc2UNCiAgICAgICAgJHJ1
YnlfdGNwc29ja2V0ICAgPSAvVENQU29ja2V0XC5ccypuZXdccypcKC4qZXhlY1xzKlwoLw0KICAg
ICAgICAkcG93ZXJzaGVsbF90Y3AgICA9IC9OZXctT2JqZWN0XHMrU3lzdGVtXC5OZXRcLlNvY2tl
dHNcLlRDUENsaWVudC8gbm9jYXNlDQogICAgICAgICRzb2NhdF9zaGVsbCAgICAgID0gL3NvY2F0
XHMrLipFWEVDLipcL2JpblwvKGJhKT9zaC8gbm9jYXNlDQogICAgICAgICRta2ZpZm9fc2hlbGwg
ICAgID0gL21rZmlmb1xzKy4qXHxccypcL2JpblwvKGJhKT9zaC8NCiAgICBjb25kaXRpb246DQog
ICAgICAgIGFueSBvZiB0aGVtDQp9DQoNCnJ1bGUgYmFja2Rvb3JfcGVyc2lzdGVuY2UNCnsNCiAg
ICBtZXRhOg0KICAgICAgICBkZXNjcmlwdGlvbiA9ICJCYWNrZG9vciBwZXJzaXN0ZW5jZSB3aXRo
IG1hbGljaW91cyBwYXlsb2FkcyAoc2hlbGwgY29tbWFuZHMsIFNTSCBrZXkgaW5qZWN0aW9uLCBo
aWRkZW4gcm9vdCB1c2VycykiDQogICAgICAgIGNhdGVnb3J5ID0gIm1hbHdhcmUiDQogICAgICAg
IHNldmVyaXR5ID0gIkhJR0giDQogICAgICAgIGNvbmZpZGVuY2UgPSAiMC43NSINCiAgICAgICAg
cmVmZXJlbmNlID0gImh0dHBzOi8vZ2l0aHViLmNvbS9OZW8yM3gwL3NpZ25hdHVyZS1iYXNlIg0K
ICAgIHN0cmluZ3M6DQogICAgICAgICRoaWRkZW5fdXNlciAgICAgICA9IC91c2VyYWRkXHMrLiot
b1xzKy11XHMrMC8gbm9jYXNlDQogICAgICAgICRjcm9uX3BlcnNpc3QgICAgICA9IC9jcm9udGFi
XHMuKihjdXJsfHdnZXR8bmN8YmFzaHxweXRob24pLyBub2Nhc2UNCiAgICAgICAgJHNzaF9pbmpl
Y3QgICAgICAgID0gL2VjaG9ccysuKj4+P1xzKi4qXC5zc2hcL2F1dGhvcml6ZWRfa2V5cy8gbm9j
YXNlDQogICAgICAgICRzeXN0ZW1kX3BlcnNpc3QgICA9IC9cW1NlcnZpY2VcXS4qRXhlY1N0YXJ0
LioobmN8YmFzaHxweXRob258Y3VybCkvIG5vY2FzZQ0KICAgICAgICAkYmFzaHJjX3BlcnNpc3Qg
ICAgPSAvZWNob1xzKy4qPj4/XHMqLipcLmJhc2hyYy8gbm9jYXNlDQogICAgICAgICRwcm9maWxl
X3BlcnNpc3QgICA9IC9lY2hvXHMrLio+Pj9ccyouKlwucHJvZmlsZS8gbm9jYXNlDQogICAgICAg
ICRpbml0X3BlcnNpc3QgICAgICA9IC9cL2V0Y1wvaW5pdFwuZFwvLioobmN8YmFzaHxyZXZlcnNl
KS8gbm9jYXNlDQogICAgICAgICRsZF9wcmVsb2FkICAgICAgICA9IC9MRF9QUkVMT0FELipcLnNv
LyBub2Nhc2UNCiAgICBjb25kaXRpb246DQogICAgICAgIGFueSBvZiB0aGVtDQp9DQoNCnJ1bGUg
a2V5bG9nZ2VyX2luZGljYXRvcnMNCnsNCiAgICBtZXRhOg0KICAgICAgICBkZXNjcmlwdGlvbiA9
ICJLZXlsb2dnZXIgZnVuY3Rpb25hbGl0eSBpbiBzY3JpcHRzIG9yIHNvdXJjZSBjb2RlIg0KICAg
ICAgICBjYXRlZ29yeSA9ICJtYWx3YXJlIg0KICAgICAgICBzZXZlcml0eSA9ICJISUdIIg0KICAg
ICAgICBjb25maWRlbmNlID0gIjAuNyINCiAgICBzdHJpbmdzOg0KICAgICAgICAkcHlucHV0ICAg
ICAgICAgPSAvZnJvbVxzK3B5bnB1dFwua2V5Ym9hcmRccytpbXBvcnQvIG5vY2FzZQ0KICAgICAg
ICAka2V5Ym9hcmRfaG9vayAgPSAva2V5Ym9hcmRcLihvbl9wcmVzc3xob29rfG9uX3JlbGVhc2Up
LyBub2Nhc2UNCiAgICAgICAgJHhpbnB1dF90ZXN0ICAgID0gL3hpbnB1dFxzK3Rlc3QvIG5vY2Fz
ZQ0KICAgICAgICAkbG9na2V5cyAgICAgICAgPSAvbG9na2V5c1xzKy0tc3RhcnQvIG5vY2FzZQ0K
ICAgICAgICAka2V5YmRfZXZlbnQgICAgPSAvKEdldEFzeW5jS2V5U3RhdGV8U2V0V2luZG93c0hv
b2tFeC4qV0hfS0VZQk9BUkQpLyBub2Nhc2UNCiAgICBjb25kaXRpb246DQogICAgICAgIGFueSBv
ZiB0aGVtDQp9DQoNCnJ1bGUgcmFuc29td2FyZV9iZWhhdmlvcg0Kew0KICAgIG1ldGE6DQogICAg
ICAgIGRlc2NyaXB0aW9uID0gIlJhbnNvbXdhcmUtbGlrZSBwYXR0ZXJucyAobWFzcyBlbmNyeXB0
aW9uLCByYW5zb20gbm90ZXMpIg0KICAgICAgICBjYXRlZ29yeSA9ICJtYWx3YXJlIg0KICAgICAg
ICBzZXZlcml0eSA9ICJDUklUSUNBTCINCiAgICAgICAgY29uZmlkZW5jZSA9ICIwLjgiDQogICAg
c3RyaW5nczoNCiAgICAgICAgJHdhbGtfZW5jcnlwdCAgID0gL29zXC53YWxrXHMqXCguKlwuKGVu
Y3J5cHR8Y2lwaGVyKS8NCiAgICAgICAgJHJhbnNvbV9ub3RlICAgID0gLyh5b3VyXHMrZmlsZXNc
cysoaGF2ZVxzK2JlZW58YXJlKVxzK2VuY3J5cHRlZHxwYXlccysuKmJpdGNvaW58c2VuZFxzKy4q
YnRjKS8gbm9jYXNlDQogICAgICAgICRleHRfcmVuYW1lICAgICA9IC9vc1wucmVuYW1lXHMqXCgu
KlwrXHMqWyciXVwuKGxvY2tlZHxlbmNyeXB0ZWR8Y3J5cHR8ZW5jKVsnIl1ccypcKS8NCiAgICAg
ICAgJG1hc3Nfb3ZlcndyaXRlID0gL29zXC53YWxrXHMqXCguKm9wZW5ccypcKC4qWydcIl13Ylsn
XCJdXCkvDQogICAgY29uZGl0aW9uOg0KICAgICAgICBhbnkgb2YgdGhlbQ0KfQ0KDQpydWxlIGMy
X2ZyYW1ld29ya19pbmRpY2F0b3JzDQp7DQogICAgbWV0YToNCiAgICAgICAgZGVzY3JpcHRpb24g
PSAiQ29tbWFuZC1hbmQtY29udHJvbCBmcmFtZXdvcmsgaW5kaWNhdG9ycyAoQ29iYWx0IFN0cmlr
ZSwgTWV0YXNwbG9pdCwgU2xpdmVyLCBldGMuKSINCiAgICAgICAgY2F0ZWdvcnkgPSAibWFsd2Fy
ZSINCiAgICAgICAgc2V2ZXJpdHkgPSAiQ1JJVElDQUwiDQogICAgICAgIGNvbmZpZGVuY2UgPSAi
MC44NSINCiAgICAgICAgcmVmZXJlbmNlID0gImh0dHBzOi8vZ2l0aHViLmNvbS9OZW8yM3gwL3Np
Z25hdHVyZS1iYXNlIg0KICAgIHN0cmluZ3M6DQogICAgICAgICRjb2JhbHRfc3RyaWtlICA9ICJj
b2JhbHRzdHJpa2UiIG5vY2FzZQ0KICAgICAgICAkbWV0ZXJwcmV0ZXIgICAgPSAibWV0ZXJwcmV0
ZXIiIG5vY2FzZQ0KICAgICAgICAkbWV0YXNwbG9pdCAgICAgPSAvbWV0YXNwbG9pdC4qKHBheWxv
YWR8ZXhwbG9pdHxzdGFnZXIpLyBub2Nhc2UNCiAgICAgICAgJGVtcGlyZSAgICAgICAgID0gL3Bv
d2Vyc2hlbGwuKmVtcGlyZS8gbm9jYXNlDQogICAgICAgICRzbGl2ZXJfYzIgICAgICA9IC9zbGl2
ZXIuKihpbXBsYW50fGJlYWNvbnxzZXNzaW9uKS8gbm9jYXNlDQogICAgICAgICRjb3ZlbmFudCAg
ICAgICA9IC9Db3ZlbmFudC4qKEdydW50fExpc3RlbmVyKS8gbm9jYXNlDQogICAgICAgICRoYXZv
Y19jMiAgICAgICA9IC9oYXZvYy4qKGRlbW9ufHRlYW1zZXJ2ZXIpLyBub2Nhc2UNCiAgICAgICAg
JGJlYWNvbl9jb25maWcgID0gLyhCZWFjb25UeXBlfEMyU2VydmVyfFB1YmxpY0tleS4qd2F0ZXJt
YXJrKS8gbm9jYXNlDQogICAgY29uZGl0aW9uOg0KICAgICAgICBhbnkgb2YgdGhlbQ0KfQ0KDQpy
dWxlIGluZm9fc3RlYWxlcg0Kew0KICAgIG1ldGE6DQogICAgICAgIGRlc2NyaXB0aW9uID0gIklu
Zm9ybWF0aW9uIHN0ZWFsZXIgcGF0dGVybnMgKGNyZWRlbnRpYWwgaGFydmVzdGluZywgYnJvd3Nl
ciBkYXRhIHRoZWZ0KSINCiAgICAgICAgY2F0ZWdvcnkgPSAibWFsd2FyZSINCiAgICAgICAgc2V2
ZXJpdHkgPSAiSElHSCINCiAgICAgICAgY29uZmlkZW5jZSA9ICIwLjc1Ig0KICAgICAgICByZWZl
cmVuY2UgPSAiaHR0cHM6Ly9naXRodWIuY29tL05lbzIzeDAvc2lnbmF0dXJlLWJhc2UiDQogICAg
c3RyaW5nczoNCiAgICAgICAgJGNocm9tZV9sb2dpbiAgICAgPSAvQ2hyb21lLipMb2dpblxzKkRh
dGEvIG5vY2FzZQ0KICAgICAgICAkZmlyZWZveF9sb2dpbnMgICA9IC9sb2dpbnNcLmpzb24uKmZp
cmVmb3gvIG5vY2FzZQ0KICAgICAgICAkYnJvd3Nlcl9jb29raWVzICA9IC9Db29raWVzLiooY2hy
b21lfGZpcmVmb3h8ZWRnZXxvcGVyYSkvIG5vY2FzZQ0KICAgICAgICAkd2FsbGV0X3N0ZWFsICAg
ICA9IC93YWxsZXRcLmRhdC8gbm9jYXNlDQogICAgICAgICRtaW1pa2F0eiAgICAgICAgID0gIm1p
bWlrYXR6IiBub2Nhc2UNCiAgICAgICAgJGxhemFnbmUgICAgICAgICAgPSAibGF6YWduZSIgbm9j
YXNlDQogICAgICAgICRjcmVkX2R1bXBfc2FtICAgID0gL3JlZ1xzK3NhdmVccysuKlxcc2FtLyBu
b2Nhc2UNCiAgICAgICAgJG50ZHNfZHVtcCAgICAgICAgPSAvbnRkc1wuZGl0LyBub2Nhc2UNCiAg
ICBjb25kaXRpb246DQogICAgICAgIGFueSBvZiB0aGVtDQp9DQo=
XCguezAsMjAwfVNPQ0tfU1RSRUFNLnswLDIwMH1cLmNvbm5lY3RcKC9zCiAgICAgICAgJHB5dGhv
bl9yZWRpcmVjdCAgPSAvKG9zXC5kdXAyfGR1cDIpXHMqXCguKlswMTJdL3MKICAgICAgICAkcHl0
aG9uX3NoZWxsICAgICA9IC8oc3VicHJvY2Vzc1wuKGNhbGx8UG9wZW58cnVuKXxvc1wuc3lzdGVt
fHB0eVwuc3Bhd24pXHMqXCguKlwvYmluXC8oYmEpP3NoL3Mgbm9jYXNlCiAgICAgICAgJHBlcmxf
c29ja2V0ICAgICAgPSAvdXNlXHMrU29ja2V0Oy57MCwyMDB9c29ja2V0XHMqXChccypTT0NLL3MK
ICAgICAgICAkcGVybF9yZWRpcmVjdCAgICA9IC8ob3BlbnxkdXAyKVxzKlwoLiooU1RESU58U1RE
T1VUfFNUREVSUnxbMDEyXSkvcyBub2Nhc2UKICAgICAgICAkcGVybF9zaGVsbCAgICAgICA9IC8o
c3lzdGVtfGV4ZWMpXHMqXCg/XHMqWyInXT9cLz9iaW5cLyhiYSk/c2gvcyBub2Nhc2UKICAgICAg
ICAkcGhwX2Zzb2NrICAgICAgICA9IC9mc29ja29wZW5ccypcKC4qZXhlY1xzKlwoLyBub2Nhc2UN
CiAgICAgICAgJHJ1YnlfdGNwc29ja2V0ICAgPSAvVENQU29ja2V0XC5ccypuZXdccypcKC4qZXhl
Y1xzKlwoLw0KICAgICAgICAkcG93ZXJzaGVsbF90Y3AgICA9IC9OZXctT2JqZWN0XHMrU3lzdGVt
XC5OZXRcLlNvY2tldHNcLlRDUENsaWVudC8gbm9jYXNlDQogICAgICAgICRzb2NhdF9zaGVsbCAg
ICAgID0gL3NvY2F0XHMrLipFWEVDLipcL2JpblwvKGJhKT9zaC8gbm9jYXNlDQogICAgICAgICRt
a2ZpZm9fc2hlbGwgICAgID0gL21rZmlmb1xzKy4qXHxccypcL2JpblwvKGJhKT9zaC8NCiAgICBj
b25kaXRpb246DQogICAgICAgICRiYXNoX3JldnNoZWxsIG9yCiAgICAgICAgJG5jX3NoZWxsIG9y
CiAgICAgICAgJG5jYXRfc2hlbGwgb3IKICAgICAgICAoJHB5dGhvbl9zb2NrZXQgYW5kICRweXRo
b25fcmVkaXJlY3QgYW5kICRweXRob25fc2hlbGwpIG9yCiAgICAgICAgKCRwZXJsX3NvY2tldCBh
bmQgJHBlcmxfcmVkaXJlY3QgYW5kICRwZXJsX3NoZWxsKSBvcgogICAgICAgICRwaHBfZnNvY2sg
b3IKICAgICAgICAkcnVieV90Y3Bzb2NrZXQgb3IKICAgICAgICAkcG93ZXJzaGVsbF90Y3Agb3IK
ICAgICAgICAkc29jYXRfc2hlbGwgb3IKICAgICAgICAkbWtmaWZvX3NoZWxsCn0KDQpydWxlIGJh
Y2tkb29yX3BlcnNpc3RlbmNlDQp7DQogICAgbWV0YToNCiAgICAgICAgZGVzY3JpcHRpb24gPSAi
QmFja2Rvb3IgcGVyc2lzdGVuY2Ugd2l0aCBtYWxpY2lvdXMgcGF5bG9hZHMgKHNoZWxsIGNvbW1h
bmRzLCBTU0gga2V5IGluamVjdGlvbiwgaGlkZGVuIHJvb3QgdXNlcnMpIg0KICAgICAgICBjYXRl
Z29yeSA9ICJtYWx3YXJlIg0KICAgICAgICBzZXZlcml0eSA9ICJISUdIIg0KICAgICAgICBjb25m
aWRlbmNlID0gIjAuNzUiDQogICAgICAgIHJlZmVyZW5jZSA9ICJodHRwczovL2dpdGh1Yi5jb20v
TmVvMjN4MC9zaWduYXR1cmUtYmFzZSINCiAgICBzdHJpbmdzOg0KICAgICAgICAkaGlkZGVuX3Vz
ZXIgICAgICAgPSAvdXNlcmFkZFxzKy4qLW9ccystdVxzKzAvIG5vY2FzZQ0KICAgICAgICAkY3Jv
bl9wZXJzaXN0ICAgICAgPSAvY3JvbnRhYlxzLiooY3VybHx3Z2V0fG5jfGJhc2h8cHl0aG9uKS8g
bm9jYXNlDQogICAgICAgICRzc2hfaW5qZWN0ICAgICAgICA9IC9lY2hvXHMrLio+Pj9ccyouKlwu
c3NoXC9hdXRob3JpemVkX2tleXMvIG5vY2FzZQ0KICAgICAgICAkc3lzdGVtZF9wZXJzaXN0ICAg
PSAvXFtTZXJ2aWNlXF0uKkV4ZWNTdGFydC4qKG5jfGJhc2h8cHl0aG9ufGN1cmwpLyBub2Nhc2UN
CiAgICAgICAgJGJhc2hyY19wZXJzaXN0ICAgID0gL2VjaG9ccysuKj4+P1xzKi4qXC5iYXNocmMv
IG5vY2FzZQ0KICAgICAgICAkcHJvZmlsZV9wZXJzaXN0ICAgPSAvZWNob1xzKy4qPj4/XHMqLipc
LnByb2ZpbGUvIG5vY2FzZQ0KICAgICAgICAkaW5pdF9wZXJzaXN0ICAgICAgPSAvXC9ldGNcL2lu
aXRcLmRcLy4qKG5jfGJhc2h8cmV2ZXJzZSkvIG5vY2FzZQ0KICAgICAgICAkbGRfcHJlbG9hZCAg
ICAgICAgPSAvTERfUFJFTE9BRC4qXC5zby8gbm9jYXNlDQogICAgY29uZGl0aW9uOg0KICAgICAg
ICBhbnkgb2YgdGhlbQ0KfQ0KDQpydWxlIGtleWxvZ2dlcl9pbmRpY2F0b3JzDQp7DQogICAgbWV0
YToNCiAgICAgICAgZGVzY3JpcHRpb24gPSAiS2V5bG9nZ2VyIGZ1bmN0aW9uYWxpdHkgaW4gc2Ny
aXB0cyBvciBzb3VyY2UgY29kZSINCiAgICAgICAgY2F0ZWdvcnkgPSAibWFsd2FyZSINCiAgICAg
ICAgc2V2ZXJpdHkgPSAiSElHSCINCiAgICAgICAgY29uZmlkZW5jZSA9ICIwLjciDQogICAgc3Ry
aW5nczoNCiAgICAgICAgJHB5bnB1dCAgICAgICAgID0gL2Zyb21ccytweW5wdXRcLmtleWJvYXJk
XHMraW1wb3J0LyBub2Nhc2UNCiAgICAgICAgJGtleWJvYXJkX2hvb2sgID0gL2tleWJvYXJkXC4o
b25fcHJlc3N8aG9va3xvbl9yZWxlYXNlKS8gbm9jYXNlDQogICAgICAgICR4aW5wdXRfdGVzdCAg
ICA9IC94aW5wdXRccyt0ZXN0LyBub2Nhc2UNCiAgICAgICAgJGxvZ2tleXMgICAgICAgID0gL2xv
Z2tleXNccystLXN0YXJ0LyBub2Nhc2UNCiAgICAgICAgJGtleWJkX2V2ZW50ICAgID0gLyhHZXRB
c3luY0tleVN0YXRlfFNldFdpbmRvd3NIb29rRXguKldIX0tFWUJPQVJEKS8gbm9jYXNlDQogICAg
Y29uZGl0aW9uOg0KICAgICAgICBhbnkgb2YgdGhlbQ0KfQ0KDQpydWxlIHJhbnNvbXdhcmVfYmVo
YXZpb3INCnsNCiAgICBtZXRhOg0KICAgICAgICBkZXNjcmlwdGlvbiA9ICJSYW5zb213YXJlLWxp
a2UgcGF0dGVybnMgKG1hc3MgZW5jcnlwdGlvbiwgcmFuc29tIG5vdGVzKSINCiAgICAgICAgY2F0
ZWdvcnkgPSAibWFsd2FyZSINCiAgICAgICAgc2V2ZXJpdHkgPSAiQ1JJVElDQUwiDQogICAgICAg
IGNvbmZpZGVuY2UgPSAiMC44Ig0KICAgIHN0cmluZ3M6DQogICAgICAgICR3YWxrX2VuY3J5cHQg
ICA9IC9vc1wud2Fsa1xzKlwoLipcLihlbmNyeXB0fGNpcGhlcikvDQogICAgICAgICRyYW5zb21f
bm90ZSAgICA9IC8oeW91clxzK2ZpbGVzXHMrKGhhdmVccytiZWVufGFyZSlccytlbmNyeXB0ZWR8
cGF5XHMrLipiaXRjb2lufHNlbmRccysuKmJ0YykvIG5vY2FzZQ0KICAgICAgICAkZXh0X3JlbmFt
ZSAgICAgPSAvb3NcLnJlbmFtZVxzKlwoLipcK1xzKlsnIl1cLihsb2NrZWR8ZW5jcnlwdGVkfGNy
eXB0fGVuYylbJyJdXHMqXCkvDQogICAgICAgICRtYXNzX292ZXJ3cml0ZSA9IC9vc1wud2Fsa1xz
KlwoLipvcGVuXHMqXCguKlsnXCJdd2JbJ1wiXVwpLw0KICAgIGNvbmRpdGlvbjoNCiAgICAgICAg
YW55IG9mIHRoZW0NCn0NCg0KcnVsZSBjMl9mcmFtZXdvcmtfaW5kaWNhdG9ycw0Kew0KICAgIG1l
dGE6DQogICAgICAgIGRlc2NyaXB0aW9uID0gIkNvbW1hbmQtYW5kLWNvbnRyb2wgZnJhbWV3b3Jr
IGluZGljYXRvcnMgKENvYmFsdCBTdHJpa2UsIE1ldGFzcGxvaXQsIFNsaXZlciwgZXRjLikiDQog
ICAgICAgIGNhdGVnb3J5ID0gIm1hbHdhcmUiDQogICAgICAgIHNldmVyaXR5ID0gIkNSSVRJQ0FM
Ig0KICAgICAgICBjb25maWRlbmNlID0gIjAuODUiDQogICAgICAgIHJlZmVyZW5jZSA9ICJodHRw
czovL2dpdGh1Yi5jb20vTmVvMjN4MC9zaWduYXR1cmUtYmFzZSINCiAgICBzdHJpbmdzOg0KICAg
ICAgICAkY29iYWx0X3N0cmlrZSAgPSAiY29iYWx0c3RyaWtlIiBub2Nhc2UNCiAgICAgICAgJG1l
dGVycHJldGVyICAgID0gIm1ldGVycHJldGVyIiBub2Nhc2UNCiAgICAgICAgJG1ldGFzcGxvaXQg
ICAgID0gL21ldGFzcGxvaXQuKihwYXlsb2FkfGV4cGxvaXR8c3RhZ2VyKS8gbm9jYXNlDQogICAg
ICAgICRlbXBpcmUgICAgICAgICA9IC9wb3dlcnNoZWxsLiplbXBpcmUvIG5vY2FzZQ0KICAgICAg
ICAkc2xpdmVyX2MyICAgICAgPSAvc2xpdmVyLiooaW1wbGFudHxiZWFjb258c2Vzc2lvbikvIG5v
Y2FzZQ0KICAgICAgICAkY292ZW5hbnQgICAgICAgPSAvQ292ZW5hbnQuKihHcnVudHxMaXN0ZW5l
cikvIG5vY2FzZQ0KICAgICAgICAkaGF2b2NfYzIgICAgICAgPSAvaGF2b2MuKihkZW1vbnx0ZWFt
c2VydmVyKS8gbm9jYXNlDQogICAgICAgICRiZWFjb25fY29uZmlnICA9IC8oQmVhY29uVHlwZXxD
MlNlcnZlcnxQdWJsaWNLZXkuKndhdGVybWFyaykvIG5vY2FzZQ0KICAgIGNvbmRpdGlvbjoNCiAg
ICAgICAgYW55IG9mIHRoZW0NCn0NCg0KcnVsZSBpbmZvX3N0ZWFsZXINCnsNCiAgICBtZXRhOg0K
ICAgICAgICBkZXNjcmlwdGlvbiA9ICJJbmZvcm1hdGlvbiBzdGVhbGVyIHBhdHRlcm5zIChjcmVk
ZW50aWFsIGhhcnZlc3RpbmcsIGJyb3dzZXIgZGF0YSB0aGVmdCkiDQogICAgICAgIGNhdGVnb3J5
ID0gIm1hbHdhcmUiDQogICAgICAgIHNldmVyaXR5ID0gIkhJR0giDQogICAgICAgIGNvbmZpZGVu
Y2UgPSAiMC43NSINCiAgICAgICAgcmVmZXJlbmNlID0gImh0dHBzOi8vZ2l0aHViLmNvbS9OZW8y
M3gwL3NpZ25hdHVyZS1iYXNlIg0KICAgIHN0cmluZ3M6DQogICAgICAgICRjaHJvbWVfbG9naW4g
ICAgID0gL0Nocm9tZS4qTG9naW5ccypEYXRhLyBub2Nhc2UNCiAgICAgICAgJGZpcmVmb3hfbG9n
aW5zICAgPSAvbG9naW5zXC5qc29uLipmaXJlZm94LyBub2Nhc2UNCiAgICAgICAgJGJyb3dzZXJf
Y29va2llcyAgPSAvQ29va2llcy4qKGNocm9tZXxmaXJlZm94fGVkZ2V8b3BlcmEpLyBub2Nhc2UN
CiAgICAgICAgJHdhbGxldF9zdGVhbCAgICAgPSAvd2FsbGV0XC5kYXQvIG5vY2FzZQ0KICAgICAg
ICAkbWltaWthdHogICAgICAgICA9ICJtaW1pa2F0eiIgbm9jYXNlDQogICAgICAgICRsYXphZ25l
ICAgICAgICAgID0gImxhemFnbmUiIG5vY2FzZQ0KICAgICAgICAkY3JlZF9kdW1wX3NhbSAgICA9
IC9yZWdccytzYXZlXHMrLipcXHNhbS8gbm9jYXNlDQogICAgICAgICRudGRzX2R1bXAgICAgICAg
ID0gL250ZHNcLmRpdC8gbm9jYXNlDQogICAgY29uZGl0aW9uOg0KICAgICAgICBhbnkgb2YgdGhl
bQ0KfQ0K
37 changes: 37 additions & 0 deletions tests/nodes/analyzers/test_static_yara.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -592,6 +592,43 @@ def test_builtin_malware_finding_preserved(self):
assert _has_rule(findings, "reverse_shell")
assert any(f.rule_id == "YR1" for f in findings)

@pytest.mark.parametrize(
"content",
[
"""
import socket

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((\"127.0.0.1\", 4444))

@rng1995 rng1995 Sep 23, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[P0] This is an ordinary TCP client: it creates a stream socket and connects, but never redirects I/O or launches a shell. Treating it as the positive reverse_shell fixture demonstrates that the widened rule will emit a CRITICAL YR1 finding for benign networking code. Tighten the packaged signature to require shell-specific behavior, then keep this shape as a negative regression and use an encoded, complete reverse shell for the positive case.

""",
"""
use Socket;

socket(SOCK, PF_INET, SOCK_STREAM, getprotobyname(\"tcp\"));
connect(SOCK, sockaddr_in(4444, inet_aton(\"127.0.0.1\")));
""",
],
ids=["python", "perl"],
)
def test_builtin_malware_does_not_flag_multiline_socket_clients(self, content):
findings = _run_builtin(content, "socket-client.txt")

assert not _has_rule(findings, "reverse_shell")

@pytest.mark.parametrize(
"encoded_content",
[
"aW1wb3J0IG9zLCBzb2NrZXQsIHN1YnByb2Nlc3MKc29jayA9IHNvY2tldC5zb2NrZXQoc29ja2V0LkFGX0lORVQsIHNvY2tldC5TT0NLX1NUUkVBTSkKc29jay5jb25uZWN0KCgnMTI3LjAuMC4xJywgNDQ0NCkpCm9zLmR1cDIoc29jay5maWxlbm8oKSwgMCkKc3VicHJvY2Vzcy5jYWxsKFsnL2Jpbi9zaCcsICctaSddKQo=",
"dXNlIFNvY2tldDsKc29ja2V0KFNPQ0ssIFBGX0lORVQsIFNPQ0tfU1RSRUFNLCBnZXRwcm90b2J5bmFtZSgidGNwIikpOwpjb25uZWN0KFNPQ0ssIHNvY2thZGRyX2luKDQ0NDQsIGluZXRfYXRvbigiMTI3LjAuMC4xIikpKTsKb3BlbihTVERJTiwgJzwmU09DSycpOyBvcGVuKFNURE9VVCwgJz4mU09DSycpOyBvcGVuKFNUREVSUiwgJz4mU09DSycpOyBleGVjKCcvYmluL3NoJyk7Cg==",
],
ids=["python", "perl"],
)
def test_builtin_malware_finding_covers_multiline_socket_shells(self, encoded_content):
content = base64.b64decode(encoded_content).decode()
findings = _run_builtin(content, "reverse-shell.txt")

assert _has_rule(findings, "reverse_shell")

def test_extra_rules_still_match_with_builtin_malware_representation(self, tmp_path):
_write_rule(
tmp_path,
Expand Down
Loading