Skip to content

Commit 2dbf4e5

Browse files
narharimegibs
andauthored
chore: add false positive for zabbix agent binaries (#1526)
Co-authored-by: Evan Gibler <20933572+egibs@users.noreply.github.com>
1 parent 880710a commit 2dbf4e5

1 file changed

Lines changed: 14 additions & 0 deletions

File tree

rules/false_positives/zabbix.yara

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
rule zabbix_binary: override {
2+
meta:
3+
description = "Zabbix monitoring system - agent, server, proxy, get, sender"
4+
curl_easy = "low"
5+
proc_s_cmdline = "low"
6+
proc_d_cmdline = "low"
7+
8+
strings:
9+
$vendor = "Zabbix SIA"
10+
$homepage = "Zabbix home page: <https://www.zabbix.com>"
11+
12+
condition:
13+
filesize < 10MB and all of them
14+
}

0 commit comments

Comments
 (0)