Clean up false positives

Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>

Author: egibs

pkg/report/report.go

@@ -365,7 +365,7 @@ func TrimPrefixes(path string, prefixes []string) string {
 	return path
 }
 
-// fileMatchesRules checks the scanned file's type against a rule's defined filetypes
+// fileMatchesRules checks the scanned file's type against a rule's defined filetypes.
 func fileMatchesRule(meta []yarax.Metadata, mime string) bool {
 	for _, m := range meta {
 		if m.Identifier() == "filetypes" {

rules/c2/tool_transfer/download.yara

@@ -26,6 +26,7 @@ rule download_sites: high {
     $not_manual      = "manually upload"
     $not_paste_go    = "paste.go"
     $not_netlify     = "netlify.app"
+    $not_misp_galaxy = "misp-galaxy:"
 
   condition:
     any of ($d_*) and none of ($not*)
@@ -56,8 +57,10 @@ rule pastebin: medium {
   strings:
     $d_pastebin = /[\w\.]{1,128}astebin[\w\.\/]{1,128}/
 
+    $not_misp_galaxy = "misp-galaxy:"
+
   condition:
-    any of ($d_*)
+    any of ($d_*) and none of ($not*)
 }
 
 rule program_dropper_url: medium {

rules/c2/tool_transfer/exe_url.yara

@@ -5,7 +5,7 @@ rule http_url_with_exe: high {
   strings:
     $exe_url         = /https*:\/\/[\w\.]{0,160}[:\/\w\_\-\?\@=]{6,160}\.exe/
     $not_mongodb_404 = "https://docs.mongodb.com/manual/reference/method/Bulk.exe"
-    $not_elastic = "\"license\": \"Elastic License v2\""
+    $not_elastic     = "\"license\": \"Elastic License v2\""
 
   condition:
     any of ($exe*) and none of ($not*)
@@ -15,7 +15,6 @@ rule http_ip_url_with_exe: critical {
   meta:
     description = "accesses hardcoded executable endpoint via IP"
 
-
   strings:
     $exe_url = /https*:\/\/[\d\.\:\[\]]{8,64}[:\/\w\_\-\?\@=]{6,160}\.exe/
 

rules/exfil/discord.yara

@@ -3,23 +3,23 @@ rule discord_bot: high {
     description = "Uses the Discord webhooks API"
 
   strings:
-    $webhook_endpoint = /discordapp.com\/api\/webhooks[\/\d]{0,32}/
+    $webhook_endpoint  = /discordapp.com\/api\/webhooks[\/\d]{0,32}/
     $webhook_endpoint2 = /discord.com\/api\/webhooks[\/\d]{0,32}/
-    $l_discordjs = "discord.js"
-    $l_discord4j = "discord4j"
-    $l_discordgo = "discordgo"
-    $l_discord = "import discord"
-    $l_disnake = "import disnake"
-    $l_hikari = "import hikari"
-    $l_interactions = "import interactions"
-    $l_nextcord = "import nextcord"
-    $l_jda = "net.dv8tion:JDA"
-    $l_discordia = "discordia"
-    $l_eris = /require\(("|')eris("|')\);/
-    $l_oceanic = /require\(("|')oceanic.js("|')\);/
-    $l_discordphp = "use Discord\\Discord;"
+    $l_discordjs       = "discord.js"
+    $l_discord4j       = "discord4j"
+    $l_discordgo       = "discordgo"
+    $l_discord         = "import discord"
+    $l_disnake         = "import disnake"
+    $l_hikari          = "import hikari"
+    $l_interactions    = "import interactions"
+    $l_nextcord        = "import nextcord"
+    $l_jda             = "net.dv8tion:JDA"
+    $l_discordia       = "discordia"
+    $l_eris            = /require\(("|')eris("|')\);/
+    $l_oceanic         = /require\(("|')oceanic.js("|')\);/
+    $l_discordphp      = "use Discord\\Discord;"
 
-    $not_pypi_index = /\"index_date\":\"\d{4}-\d{2}\d{2}\"/
+    $not_pypi_index  = /\"index_date\":\"\d{4}-\d{2}\d{2}\"/
     $not_pypi_index2 = "\"package_names\""
 
   condition:

rules/impact/remote_access/botnet.yara

@@ -28,10 +28,10 @@ rule botnet_high: high {
     description = "References a 'botnet'"
 
   strings:
-    $bot_deployed  = "bot deployed"
-    $botnet        = "Botnet"
-    $not_phishing  = "phishing"
-    $not_keylogger = "keylogger"
+    $bot_deployed                = "bot deployed"
+    $botnet                      = "Botnet"
+    $not_phishing                = "phishing"
+    $not_keylogger               = "keylogger"
     $not_wikiticker_contribution = "Undid revision 680586363 by"
 
   condition:

rules/impact/remote_access/reverse_shell.yara

@@ -27,6 +27,7 @@ rule possible_reverse_shell: medium {
     $sh_bash   = "/bin/bash"
     $sh        = "/bin/sh"
 
+    $not_elastic    = "\"license\": \"Elastic License v2\""
     $not_uc2        = "ucs2reverse"
     $not_pypi_index = "testpack-id-lb001"
 

tests/linux/clean/misp_sample.ndjson.log.simple

@@ -1,7 +1,6 @@
-# linux/clean/misp_sample.ndjson.log: high
+# linux/clean/misp_sample.ndjson.log: medium
 c2/addr/ip: medium
 c2/addr/url: medium
-c2/tool_transfer/download: high
 c2/tool_transfer/os: low
 crypto/aes: low
 crypto/decrypt: low