Skip to content

Commit

Permalink
Blacklist and remove bunch of YARA rules 1/2
Browse files Browse the repository at this point in the history
* `ft_*` are quite useless
* `mbedded_win_api` triggers on a whole bunch of header files in /usr/include
* `shell_functions` triggers on mysql.h, phpcomplete.vim & others
* `shell_names` trigger on chkrootkit :)
    * "r57shell.php"
    * Also youtube-dl
* `DarkComet_Keylogs_Memory` triggers on bunch of header files
* `PM_Dyre_Delivery1` trigger on header files
* `web_log_review` trigger on header files
* `Mozi_Obfuscation_Technique` FPs on /usr/bin/php and other parts of legit PHP
* Cerberus FPs on a whole bunch of stuff
* `CrowdStrike_CVE_2014_4113` FPs on bunch of `LC_COLLATE` files
* `dbgdetect_files` FPs on a whole bunch of legit files
* N3utrino FPs on libmariadbd.so.19, mariadbd, libclamav.so.12.0.1 & a whole bunch of others :D
* `LinuxDDOS_Agent` FPs against youtube-dl
    * Actually it looks like youtube-dl is quite good candidate for goodware corpus :)
* `shellshock_generic` FPs on /usr/lib64/gcc/x86_64-slackware-linux/11.2.0/include/d/std/algorithm/iteration.d (gcc-gdc package)
* `memory_shylock` is too generic. E.g. "$b = /id=[A-F0-9]{32}/"
* etc. etc.
  • Loading branch information
pyllyukko committed Dec 8, 2023
1 parent e07aaca commit 8e6456f
Showing 1 changed file with 15 additions and 16 deletions.
31 changes: 15 additions & 16 deletions tasks/clamav.yml
Original file line number Diff line number Diff line change
Expand Up @@ -266,6 +266,20 @@
blackhole_basic
blackhole2_css
Contains_VBE_File
ft_gzip
mbedded_win_api
shell_functions
shell_names
DarkComet_Keylogs_Memory
PM_Dyre_Delivery1
web_log_review
Mozi_Obfuscation_Technique
Cerberus
dbgdetect_files
N3utrino
LinuxDDOS_Agent
shellshock_generic
memory_shylock
tags:
- configuration
- yara
Expand Down Expand Up @@ -2970,26 +2984,11 @@
- https://raw.githubusercontent.com/mikesxrs/Open-Source-YARA-rules/master/NCSC/SparrowDoor_xor.yar
- https://raw.githubusercontent.com/mikesxrs/Open-Source-YARA-rules/master/NCSC/SparrowDoor_apipatch.yar
- https://raw.githubusercontent.com/mikesxrs/Open-Source-YARA-rules/master/Niels%20Warnars/encoded_vbs.yar
- https://raw.githubusercontent.com/mikesxrs/Open-Source-YARA-rules/master/Niels%20Warnars/office_filetype.yar
- https://raw.githubusercontent.com/mikesxrs/Open-Source-YARA-rules/master/Pasquale%20Stirparo/beef_pretty_theft.yar
- https://raw.githubusercontent.com/mikesxrs/Open-Source-YARA-rules/master/Xylitol/Zeus_1134.yar
- https://raw.githubusercontent.com/mikesxrs/Open-Source-YARA-rules/master/Xylitol/ibanking.yar
- https://raw.githubusercontent.com/mikesxrs/Open-Source-YARA-rules/master/contextis/Trojan_W32_Gh0stMiancha_1_0_0.yar
- https://raw.githubusercontent.com/mikesxrs/Open-Source-YARA-rules/master/EmersonElectricCo/ft_cab.yara
- https://raw.githubusercontent.com/mikesxrs/Open-Source-YARA-rules/master/EmersonElectricCo/ft_rar.yara
- https://raw.githubusercontent.com/mikesxrs/Open-Source-YARA-rules/master/EmersonElectricCo/misc_ooxml_core_properties.yara
- https://raw.githubusercontent.com/mikesxrs/Open-Source-YARA-rules/master/EmersonElectricCo/ft_rtf.yara
- https://raw.githubusercontent.com/mikesxrs/Open-Source-YARA-rules/master/EmersonElectricCo/ft_tar.yara
- https://raw.githubusercontent.com/mikesxrs/Open-Source-YARA-rules/master/EmersonElectricCo/ft_gzip.yara
- https://raw.githubusercontent.com/mikesxrs/Open-Source-YARA-rules/master/EmersonElectricCo/ft_java_class.yara
- https://raw.githubusercontent.com/mikesxrs/Open-Source-YARA-rules/master/EmersonElectricCo/ft_ole_cf.yara
- https://raw.githubusercontent.com/mikesxrs/Open-Source-YARA-rules/master/EmersonElectricCo/ft_exe.yara
- https://raw.githubusercontent.com/mikesxrs/Open-Source-YARA-rules/master/EmersonElectricCo/ft_elf.yara
- https://raw.githubusercontent.com/mikesxrs/Open-Source-YARA-rules/master/EmersonElectricCo/ft_office_open_xml.yara
- https://raw.githubusercontent.com/mikesxrs/Open-Source-YARA-rules/master/EmersonElectricCo/ft_zip.yara
- https://raw.githubusercontent.com/mikesxrs/Open-Source-YARA-rules/master/EmersonElectricCo/ft_pdf.yara
- https://raw.githubusercontent.com/mikesxrs/Open-Source-YARA-rules/master/EmersonElectricCo/ft_jar.yara
- https://raw.githubusercontent.com/mikesxrs/Open-Source-YARA-rules/master/EmersonElectricCo/misc_hexascii_pe_in_html.yara
- https://raw.githubusercontent.com/EmersonElectricCo/fsf/master/fsf-server/yara/misc_hexascii_pe_in_html.yara
- https://raw.githubusercontent.com/mikesxrs/Open-Source-YARA-rules/master/Checkpoint/injector_ZZ_dotRunpeX.yar
- https://raw.githubusercontent.com/mikesxrs/Open-Source-YARA-rules/master/Checkpoint/injector_ZZ_dotRunpeX_oldnew.yar
- https://raw.githubusercontent.com/mikesxrs/Open-Source-YARA-rules/master/WalmartGlobalTech/cs_hexlified_stager_sc.yar
Expand Down

1 comment on commit 8e6456f

@pyllyukko
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

#84

Please sign in to comment.