feat(scanner): add WebSocket-based attack detection rules#44
Open
apex-cl wants to merge 2 commits intocounterspec:mainfrom
Open
feat(scanner): add WebSocket-based attack detection rules#44apex-cl wants to merge 2 commits intocounterspec:mainfrom
apex-cl wants to merge 2 commits intocounterspec:mainfrom
Conversation
Adds GitLab CI/CD pipeline integration for the ISNAD Scanner with SARIF (Static Analysis Results Interchange Format) output compatible with GitLab Security Dashboard and GitHub Code Scanning. Changes: - Add SARIF export module (scanner/src/sarif.ts) - analysisResultToSarif() converts scan results to SARIF 2.1.0 format - Maps severity levels: critical/high->error, medium->warning, low->note - Includes artifact locations, line numbers, code snippets, and rules - Extend CLI with --sarif-output flag (scanner/src/cli.ts) - batch command now supports --sarif-output <path> option - Combines results from multiple files into a single SARIF report - Report appears in GitLab MR widget under Security tab - Add .gitlab-ci.yml template - Ready-to-use pipeline with configurable SCAN_TARGETS and SCAN_FAIL_LEVEL - SARIF artifact uploaded for GitLab SAST reports - Runs on push, MR, and scheduled pipelines - Add .gitlab-ci-templates.yml with advanced templates - Auto-issue creation on critical findings via GitLab API - Add documentation (docs/GITLAB_CI.md) - Quick start guide, configuration reference, and pipeline examples - Add unit tests for SARIF export (scanner/tests/sarif.test.ts) - Tests rule generation, severity mapping, and JSON serialization Fixes: counterspec#5
Adds comprehensive scanner rules for detecting malicious WebSocket patterns commonly used in supply chain attacks and C2 communication. New patterns: - WS_SUSPICIOUS_CONNECT: Detects WebSocket connections to untrusted endpoints (potential C2 channels). Excludes known safe domains (GitHub, OpenAI, Discord, Slack, Telegram) and localhost. - WS_DATA_EXFIL: Detects sensitive data exfiltration over WebSocket channels including credentials, tokens, passwords, API keys, and environment variables. - WS_REVERSE_SHELL: Detects reverse shell patterns via WebSocket combining WebSocket with child_process module for remote code execution. - WS_PERSISTENT_C2: Detects persistent C2 communication channels via WebSocket reconnection loops (setInterval, setTimeout patterns). - WS_COMMAND_EXEC: Detects receiving and executing commands from a WebSocket server (eval, exec, Function in message handlers). All patterns include unit tests covering: - True positive detection of attack patterns - False positive prevention for legitimate WebSocket usage - Integration tests with realistic attack scenarios Resolves: counterspec#3
|
@apex-cl is attempting to deploy a commit to the Rapi's projects Team on Vercel. A member of the Team first needs to authorize it. |
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements WebSocket-based attack detection rules for the ISNAD Scanner.
Resolves Issue #3: Scanner rule for malicious WebSocket handlers
New Detection Rules
WS_SUSPICIOUS_CONNECT (critical)
WS_DATA_EXFIL (critical)
WS_REVERSE_SHELL (critical)
WS_PERSISTENT_C2 (high)
WS_COMMAND_EXEC (critical)
Tests
Comprehensive test suite (ws-detection.test.ts) covering:
All tests use the existing
analyzeContent()engine — no new dependencies.Checklist