Jwt no signature verification

[shishir-cyber]

Summary

Adds a new nursery rule, parse JWT without verifying signature, which detects code that parses a JWT-shaped string (base64 decode/split) without a nearby call to validate the signature - a pattern seen in custom C2/auth implementations that roll their own JWT handling to avoid detection or dependency fingerprinting.

Status

This is submitted to nursery/ rather than communication/http/ because it doesn't yet have a verified real-world sample for meta.examples. I'm actively looking for a suitable public malware sample that exhibits this pattern and will update the rule (and move it out of nursery) once I have one - happy to take pointers if anyone knows of a matching sample in capa-testfiles or elsewhere.

Linting

• Standard lint passes cleanly (python scripts/lint.py nursery/parse-jwt-without-verifying-signature.yml → no lints failed, nice!)
• Thorough lint (--thorough) not run locally yet, since it requires capa-testfiles and a real example to verify against - will run once an example is added

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.