Skip to content

Commit 73897bd

Browse files
egibsegibs
authored
Revert usage of include statements (#947)
Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>
1 parent 5456c78 commit 73897bd

40 files changed

Lines changed: 584 additions & 511 deletions

‎pkg/compile/compile.go‎

Lines changed: 0 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,11 @@
44
package compile
55

66
import (
7-
"bytes"
87
"context"
98
"fmt"
109
"io/fs"
11-
"os"
1210
"path/filepath"
1311
"regexp"
14-
"runtime"
1512
"strings"
1613

1714
"github.com/chainguard-dev/clog"
@@ -20,11 +17,6 @@ import (
2017
yarax "github.com/VirusTotal/yara-x/go"
2118
)
2219

23-
const (
24-
globalInclude = `include "rules/global/global.yara"`
25-
globalPath = "rules/global/global.yara"
26-
)
27-
2820
var FS = rules.FS
2921

3022
// badRules are noisy 3rd party rules to silently disable.
@@ -167,47 +159,6 @@ func removeRules(data []byte, rulesToRemove []string) []byte {
167159
return newlinePattern.ReplaceAll(modified, []byte("\n\n"))
168160
}
169161

170-
// findRoot locates the packages's root directory on the fly.
171-
func findRoot() (string, error) {
172-
_, here, _, ok := runtime.Caller(0)
173-
if !ok {
174-
return "", fmt.Errorf("failed to get current file path")
175-
}
176-
177-
dir := filepath.Dir(here)
178-
current := dir
179-
for {
180-
rulesPath := filepath.Join(current, "rules")
181-
if fi, err := os.Stat(rulesPath); err == nil && fi.IsDir() {
182-
return current, nil
183-
}
184-
185-
parent := filepath.Dir(current)
186-
if parent == current {
187-
break
188-
}
189-
current = parent
190-
}
191-
192-
rulesPath := filepath.Join(filepath.Dir(dir), "rules")
193-
if fi, err := os.Stat(rulesPath); err == nil && fi.IsDir() {
194-
return filepath.Dir(dir), nil
195-
}
196-
197-
return "", fmt.Errorf("could not find rules directory from %s", dir)
198-
}
199-
200-
// replaceGlobal updates the include string to reference the absolute path of rules/global/global.yara
201-
// by default, the relative path is valid for local compilations and builds done from the root of the repository,
202-
// but this is not valid for test files located in various directories.
203-
func replaceGlobal(data []byte, path string) []byte {
204-
modified := data
205-
if bytes.Contains(data, []byte(globalInclude)) {
206-
modified = bytes.Replace(data, []byte(globalInclude), fmt.Appendf(nil, `include "%s"`, path), 1)
207-
}
208-
return modified
209-
}
210-
211162
func Recursive(ctx context.Context, fss []fs.FS) (*yarax.Rules, error) {
212163
if ctx.Err() != nil {
213164
return nil, ctx.Err()
@@ -218,11 +169,6 @@ func Recursive(ctx context.Context, fss []fs.FS) (*yarax.Rules, error) {
218169
return nil, fmt.Errorf("yarax compiler: %w", err)
219170
}
220171

221-
rootPath, err := findRoot()
222-
if err != nil {
223-
return nil, err
224-
}
225-
226172
rulesToRemove := getRulesToRemove()
227173

228174
for _, root := range fss {
@@ -243,9 +189,6 @@ func Recursive(ctx context.Context, fss []fs.FS) (*yarax.Rules, error) {
243189

244190
bs = removeRules(bs, rulesToRemove)
245191

246-
globalAbs := filepath.Join(rootPath, globalPath)
247-
bs = replaceGlobal(bs, globalAbs)
248-
249192
yxc.NewNamespace(path)
250193
if err := yxc.AddSource(string(bs), yarax.WithOrigin(path)); err != nil {
251194
return fmt.Errorf("failed to parse %s: %v", path, err)

‎rules/anti-behavior/random_behavior.yara‎

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,21 @@
11
import "math"
22

3-
include "rules/global/global.yara"
3+
private rule random_behavior_pythonSetup {
4+
strings:
5+
$if_distutils = /from distutils.core import .{0,32}setup/
6+
$if_setuptools = /from setuptools import .{0,32}setup/
7+
$i_setuptools = "import setuptools"
8+
$setup = "setup("
9+
10+
$not_setup_example = ">>> setup("
11+
$not_setup_todict = "setup(**config.todict()"
12+
$not_import_quoted = "\"from setuptools import setup"
13+
$not_setup_quoted = "\"setup(name="
14+
$not_distutils = "from distutils.errors import"
15+
16+
condition:
17+
filesize < 128KB and $setup and any of ($i*) and none of ($not*)
18+
}
419

520
rule setuptools_random: critical {
621
meta:
@@ -12,7 +27,7 @@ rule setuptools_random: critical {
1227
$not_easy_install = "pid = random.randint(0, sys.maxsize)"
1328
1429
condition:
15-
global_python_setup and $ref and none of ($not*)
30+
random_behavior_pythonSetup and $ref and none of ($not*)
1631
}
1732

1833
rule java_random: low {

‎rules/anti-static/elf/entropy.yara‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,22 @@
11
import "math"
22

3-
include "rules/global/global.yara"
3+
private rule normal_elf {
4+
condition:
5+
filesize < 64MB and uint32(0) == 1179403647
6+
}
7+
8+
private rule small_elf {
9+
condition:
10+
filesize < 400KB and uint32(0) == 1179403647
11+
}
412

513
rule higher_elf_entropy_68: medium {
614
meta:
715
description = "higher entropy ELF binary (>6.95)"
816
filetypes = "elf"
917

1018
condition:
11-
global_normal_elf and math.entropy(1, filesize) >= 6.95
19+
normal_elf and math.entropy(1, filesize) >= 6.95
1220
}
1321

1422
rule normal_elf_high_entropy_7_4: high {
@@ -21,7 +29,7 @@ rule normal_elf_high_entropy_7_4: high {
2129
$not_bazel = "BazelLogHandler"
2230
2331
condition:
24-
filesize < 30MB and global_normal_elf and math.entropy(1, filesize) >= 7.4 and none of ($not*)
32+
filesize < 30MB and normal_elf and math.entropy(1, filesize) >= 7.4 and none of ($not*)
2533
}
2634

2735
rule normal_elf_high_entropy_footer_7_4: high {
@@ -30,7 +38,7 @@ rule normal_elf_high_entropy_footer_7_4: high {
3038
filetypes = "elf"
3139

3240
condition:
33-
global_normal_elf and math.entropy(filesize - 8192, filesize) >= 7.4
41+
normal_elf and math.entropy(filesize - 8192, filesize) >= 7.4
3442
}
3543

3644
rule normal_elf_high_entropy_footer_7_4_rc4: high {
@@ -43,5 +51,5 @@ rule normal_elf_high_entropy_footer_7_4_rc4: high {
4351
$cmp_r_x_256 = { 48 81 f? 00 01 00 00 } // cmp {rbx, rcx, …}, 256
4452
4553
condition:
46-
filesize < 25MB and global_normal_elf and math.entropy(filesize - 8192, filesize) >= 7.4 and any of them
54+
filesize < 25MB and normal_elf and math.entropy(filesize - 8192, filesize) >= 7.4 and any of them
4755
}

‎rules/anti-static/macho/entropy.yara‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,17 @@
11
import "math"
22

3-
include "rules/global/global.yara"
3+
private rule smaller_macho {
4+
condition:
5+
filesize < 64MB and (uint32(0) == 4277009102 or uint32(0) == 3472551422 or uint32(0) == 4277009103 or uint32(0) == 3489328638 or uint32(0) == 3405691582 or uint32(0) == 3199925962)
6+
}
47

58
rule higher_entropy_6_9: medium {
69
meta:
710
description = "higher entropy binary (>6.9)"
811
filetypes = "macho"
912

1013
condition:
11-
global_small_macho and math.entropy(1, filesize) >= 6.9
14+
smaller_macho and math.entropy(1, filesize) >= 6.9
1215
}
1316

1417
rule high_entropy_7_2: high {
@@ -21,5 +24,5 @@ rule high_entropy_7_2: high {
2124
$bin_java = "bin/java"
2225
2326
condition:
24-
global_small_macho and math.entropy(1, filesize) >= 7.2 and not $bin_java
27+
smaller_macho and math.entropy(1, filesize) >= 7.2 and not $bin_java
2528
}

‎rules/anti-static/macho/footer.yara‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
import "math"
22

3-
include "rules/global/global.yara"
3+
private rule anti_static_macho {
4+
condition:
5+
(uint32(0) == 4277009102 or uint32(0) == 3472551422 or uint32(0) == 4277009103 or uint32(0) == 3489328638 or uint32(0) == 3405691582 or uint32(0) == 3199925962 or uint32(0) == 3405691583 or uint32(0) == 3216703178)
6+
}
47

58
rule high_entropy_trailer: high {
69
meta:
@@ -12,5 +15,5 @@ rule high_entropy_trailer: high {
1215
$page_zero = "_PAGEZERO"
1316
1417
condition:
15-
filesize < 10MB and global_macho and $page_zero and math.entropy(filesize - 1024, filesize - 1) >= 4
18+
filesize < 10MB and anti_static_macho and $page_zero and math.entropy(filesize - 1024, filesize - 1) >= 4
1619
}

‎rules/anti-static/packer/aes.yara‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,10 @@
11
import "math"
22

3-
include "rules/global/global.yara"
3+
private rule smallBinary {
4+
condition:
5+
// matches ELF or machO binary
6+
filesize > 1MB and filesize < 8MB and (uint32(0) == 1179403647 or uint32(0) == 4277009102 or uint32(0) == 3472551422 or uint32(0) == 4277009103 or uint32(0) == 3489328638 or uint32(0) == 3405691582 or uint32(0) == 3199925962)
7+
}
48

59
rule go_aes: high {
610
meta:
@@ -13,5 +17,5 @@ rule go_aes: high {
1317
$decrypt = "NewCFBDecrypter"
1418
1519
condition:
16-
global_small_binary and math.entropy(1, filesize) >= 7 and all of them
20+
smallBinary and math.entropy(1, filesize) >= 7 and all of them
1721
}

‎rules/anti-static/unmarshal/marshal.yara‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,15 @@
11
import "math"
22

3-
include "rules/global/global.yara"
3+
private rule pySetup {
4+
strings:
5+
$i_distutils = "from distutils.core import setup"
6+
$i_setuptools = "setuptools"
7+
$setup = "setup("
8+
$not_setuptools = "setuptools.command"
9+
10+
condition:
11+
filesize < 2097152 and $setup and any of ($i*) and none of ($not*)
12+
}
413

514
rule unmarshal_py_marshal: medium {
615
meta:
@@ -20,5 +29,5 @@ rule setuptools_py_marshal: suspicious {
2029
filetypes = "py"
2130

2231
condition:
23-
global_python_setup and unmarshal_py_marshal
32+
pySetup and unmarshal_py_marshal
2433
}

‎rules/c2/addr/ip.yara‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
include "rules/global/global.yara"
2-
31
rule hardcoded_ip: medium {
42
meta:
53
description = "hardcoded IP address"
@@ -21,6 +19,11 @@ rule hardcoded_ip: medium {
2119
filesize < 200MB and 1 of ($sus_ip*) and none of ($not*)
2220
}
2321

22+
private rule ip_elf_or_macho {
23+
condition:
24+
uint32(0) == 1179403647 or (uint32(0) == 4277009102 or uint32(0) == 3472551422 or uint32(0) == 4277009103 or uint32(0) == 3489328638 or uint32(0) == 3405691582 or uint32(0) == 3199925962 or uint32(0) == 3405691583 or uint32(0) == 3216703178)
25+
}
26+
2427
rule bin_hardcoded_ip: high {
2528
meta:
2629
description = "ELF with hardcoded IP address"
@@ -45,7 +48,7 @@ rule bin_hardcoded_ip: high {
4548
$not_2345 = "23.45.67.89"
4649
4750
condition:
48-
filesize < 12MB and global_elf_or_macho and 1 of ($sus_ip*) and none of ($not*)
51+
filesize < 12MB and ip_elf_or_macho and 1 of ($sus_ip*) and none of ($not*)
4952
}
5053

5154
rule http_hardcoded_ip: high exfil {

‎rules/c2/addr/url.yara‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
import "math"
22

3-
include "rules/global/global.yara"
3+
private rule elf_or_macho {
4+
condition:
5+
uint32(0) == 1179403647 or (uint32(0) == 4277009102 or uint32(0) == 3472551422 or uint32(0) == 4277009103 or uint32(0) == 3489328638 or uint32(0) == 3405691582 or uint32(0) == 3199925962 or uint32(0) == 3405691583 or uint32(0) == 3216703178)
6+
}
47

58
rule unusual_nodename: medium {
69
meta:
@@ -82,7 +85,7 @@ rule binary_with_url: low {
8285
$ref = /https*:\/\/[\w\.\/]{8,160}[\/\w\=\&]{0,32}/
8386
8487
condition:
85-
filesize < 150MB and global_elf_or_macho and $ref
88+
filesize < 150MB and elf_or_macho and $ref
8689
}
8790

8891
rule binary_url_with_question: high {
@@ -99,7 +102,7 @@ rule binary_url_with_question: high {
99102
$not_mesibo = "https://api.mesibo.com/api.php?"
100103
101104
condition:
102-
filesize < 150MB and global_elf_or_macho and $ref and none of ($not*)
105+
filesize < 150MB and elf_or_macho and $ref and none of ($not*)
103106
}
104107

105108
rule script_url_with_question: high {

‎rules/c2/tool_transfer/download.yara‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
include "rules/global/global.yara"
2-
31
rule download_sites: high {
42
meta:
53
ref = "https://github.com/ditekshen/detection/blob/e6579590779f62cbe7f5e14b5be7d77b2280f516/yara/indicator_high.yar#L1001"
@@ -115,6 +113,12 @@ rule http_archive_url: medium {
115113
any of ($ref*) and none of ($not*)
116114
}
117115

116+
private rule smallerBinary {
117+
condition:
118+
// matches ELF or machO binary
119+
filesize < 10MB and (uint32(0) == 1179403647 or uint32(0) == 4277009102 or uint32(0) == 3472551422 or uint32(0) == 4277009103 or uint32(0) == 3489328638 or uint32(0) == 3405691582 or uint32(0) == 3199925962)
120+
}
121+
118122
rule http_archive_url_higher: high {
119123
meta:
120124
description = "accesses hardcoded archive file endpoint"
@@ -125,5 +129,5 @@ rule http_archive_url_higher: high {
125129
$not_foo_bar = "http://foo/bar.tar"
126130
127131
condition:
128-
global_small_binary and any of ($ref*) and none of ($not*)
132+
smallerBinary and any of ($ref*) and none of ($not*)
129133
}

0 commit comments

Comments
 (0)