Skip to content

Commit ed9ba0c

Browse files
egibsegibs
authored
Drop user blocklist rule to high; add additional Bandit rules as well (#1037)
Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>
1 parent f846d7e commit ed9ba0c

7 files changed

Lines changed: 181 additions & 46 deletions

File tree

‎rules/anti-behavior/blocklist/ip.yara‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
rule common_ip_blocklist: high {
2+
meta:
3+
description = "avoids execution if host has particular IP address"
4+
ref = "https://www.zscaler.com/blogs/security-research/technical-analysis-bandit-stealer"
5+
6+
strings:
7+
$ = "109.145.173.169" fullword
8+
$ = "109.74.154.90" fullword
9+
$ = "109.74.154.91" fullword
10+
$ = "109.74.154.91" fullword
11+
$ = "109.74.154.92" fullword
12+
$ = "178.239.165.70" fullword
13+
$ = "188.105.91.116" fullword
14+
$ = "188.105.91.143" fullword
15+
$ = "188.105.91.173" fullword
16+
$ = "192.211.110.74" fullword
17+
$ = "192.40.57.234" fullword
18+
$ = "192.87.28.103" fullword
19+
$ = "193.128.114.45" fullword
20+
$ = "193.225.193.201" fullword
21+
$ = "194.154.78.160" fullword
22+
$ = "195.181.175.105" fullword
23+
$ = "195.239.51.3" fullword
24+
$ = "195.239.51.59" fullword
25+
$ = "195.74.76.222" fullword
26+
$ = "20.99.160.173" fullword
27+
$ = "212.119.227.151" fullword
28+
$ = "212.119.227.167" fullword
29+
$ = "213.33.142.50" fullword
30+
$ = "23.128.248.46" fullword
31+
$ = "34.105.0.27" fullword
32+
$ = "34.105.183.68" fullword
33+
$ = "34.105.72.241" fullword
34+
$ = "34.138.96.23" fullword
35+
$ = "34.141.146.114" fullword
36+
$ = "34.141.245.25" fullword
37+
$ = "34.142.74.220" fullword
38+
$ = "34.145.195.58" fullword
39+
$ = "34.145.89.174" fullword
40+
$ = "34.253.248.228" fullword
41+
$ = "34.83.46.130" fullword
42+
$ = "34.85.243.241" fullword
43+
$ = "34.85.253.170" fullword
44+
$ = "35.192.93.107" fullword
45+
$ = "35.199.6.13" fullword
46+
$ = "35.229.69.227" fullword
47+
$ = "35.237.47.12" fullword
48+
$ = "64.124.12.162" fullword
49+
$ = "78.139.8.50" fullword
50+
$ = "79.104.209.33" fullword
51+
$ = "80.211.0.97" fullword
52+
$ = "84.147.54.113" fullword
53+
$ = "84.147.62.12" fullword
54+
$ = "87.166.50.213" fullword
55+
$ = "88.132.225.100" fullword
56+
$ = "88.132.226.203" fullword
57+
$ = "88.132.227.238" fullword
58+
$ = "88.132.231.71" fullword
59+
$ = "88.153.199.169" fullword
60+
$ = "92.211.109.160" fullword
61+
$ = "92.211.192.144" fullword
62+
$ = "92.211.52.62" fullword
63+
$ = "92.211.55.199" fullword
64+
$ = "93.216.75.209" fullword
65+
$ = "95.25.204.90" fullword
66+
$ = "95.25.81.24" fullword
67+
68+
condition:
69+
2 of them
70+
}

‎rules/anti-behavior/blocklist/mac_addr.yara‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -152,3 +152,111 @@ rule common_mac_addr_blocklist: critical {
152152
condition:
153153
2 of them
154154
}
155+
156+
rule common_hardware_id_blocklist: high {
157+
meta:
158+
description = "avoids execution if host has particular hardware ID"
159+
ref = "https://www.zscaler.com/blogs/security-research/technical-analysis-bandit-stealer"
160+
161+
strings:
162+
$ = "00000000-0000-0000-0000-000000000000" fullword
163+
$ = "00000000-0000-0000-0000-50E5493391EF" fullword
164+
$ = "00000000-0000-0000-0000-AC1F6BD048FE" fullword
165+
$ = "00000000-0000-0000-0000-AC1F6BD04972" fullword
166+
$ = "00000000-0000-0000-0000-AC1F6BD04986" fullword
167+
$ = "00000000-0000-0000-0000-AC1F6BD04D98" fullword
168+
$ = "02AD9898-FA37-11EB-AC55-1D0C0A67EA8A" fullword
169+
$ = "032E02B4-0499-05C3-0806-3C0700080009" fullword
170+
$ = "03DE0294-0480-05DE-1A06-350700080009" fullword
171+
$ = "050C3342-FADD-AEDF-EF24-C6454E1A73C9" fullword
172+
$ = "05790C00-3B21-11EA-8000-3CECEF4400D0" fullword
173+
$ = "07E42E42-F43D-3E1C-1C6B-9C7AC120F3B9" fullword
174+
$ = "08C1E400-3C56-11EA-8000-3CECEF43FEDE" fullword
175+
$ = "0934E336-72E4-4E6A-B3E5-383BD8E938C3" fullword
176+
$ = "11111111-2222-3333-4444-555555555555" fullword
177+
$ = "119602E8-92F9-BD4B-8979-DA682276D385" fullword
178+
$ = "12204D56-28C0-AB03-51B7-44A8B7525250" fullword
179+
$ = "12EE3342-87A2-32DE-A390-4C2DA4D512E9" fullword
180+
$ = "1D4D3342-D6C4-710C-98A3-9CC6571234D5" fullword
181+
$ = "2DD1B176-C043-49A4-830F-C623FFB88F3C" fullword
182+
$ = "2E6FB594-9D55-4424-8E74-CE25A25E36B0" fullword
183+
$ = "365B4000-3B25-11EA-8000-3CECEF44010C" fullword
184+
$ = "38813342-D7D0-DFC8-C56F-7FC9DFE5C972" fullword
185+
$ = "38AB3342-66B0-7175-0B23-F390B3728B78" fullword
186+
$ = "3A9F3342-D1F2-DF37-68AE-C10F60BFB462" fullword
187+
$ = "3F284CA4-8BDF-489B-A273-41B44D668F6D" fullword
188+
$ = "3F3C58D1-B4F2-4019-B2A2-2A500E96AF2E" fullword
189+
$ = "42A82042-3F13-512F-5E3D-6BF4FFFD8518" fullword
190+
$ = "44B94D56-65AB-DC02-86A0-98143A7423BF" fullword
191+
$ = "4729AEB0-FC07-11E3-9673-CE39E79C8A00" fullword
192+
$ = "48941AE9-D52F-11DF-BBDA-503734826431" fullword
193+
$ = "49434D53-0200-9036-2500-369025000C65" fullword
194+
$ = "49434D53-0200-9036-2500-369025003865" fullword
195+
$ = "49434D53-0200-9036-2500-369025003AF0" fullword
196+
$ = "49434D53-0200-9036-2500-36902500F022" fullword
197+
$ = "49434D53-0200-9065-2500-65902500E439" fullword
198+
$ = "4C4C4544-0050-3710-8058-CAC04F59344A" fullword
199+
$ = "4CB82042-BA8F-1748-C941-363C391CA7F3" fullword
200+
$ = "4D4DDC94-E06C-44F4-95FE-33A1ADA5AC27" fullword
201+
$ = "4DC32042-E601-F329-21C1-03F27564FD6C" fullword
202+
$ = "5BD24D56-789F-8468-7CDC-CAA7222CC121" fullword
203+
$ = "5E3E7FE0-2636-4CB7-84F5-8D2650FFEC0E" fullword
204+
$ = "5EBD2E42-1DB8-78A6-0EC3-031B661D5C57" fullword
205+
$ = "60C83342-0A97-928D-7316-5F1080A78E72" fullword
206+
$ = "63203342-0EB0-AA1A-4DF5-3FB37DBB0670" fullword
207+
$ = "63FA3342-31C7-4E8E-8089-DAFF6CE5E967" fullword
208+
$ = "6608003F-ECE4-494E-B07E-1C4615D1D93C" fullword
209+
$ = "67E595EB-54AC-4FF0-B5E3-3DA7C7B547E3" fullword
210+
$ = "6ECEAF72-3548-476C-BD8D-73134A9182C8" fullword
211+
$ = "6F3CA5EC-BEC9-4A4D-8274-11168F640058" fullword
212+
$ = "777D84B3-88D1-451C-93E4-D235177420A7" fullword
213+
$ = "79AF5279-16CF-4094-9758-F88A616D81B4" fullword
214+
$ = "7AB5C494-39F5-4941-9163-47F54D6D5016" fullword
215+
$ = "84FE3342-6C67-5FC6-5639-9B3CA3D775A1" fullword
216+
$ = "88DC3342-12E6-7D62-B0AE-C80E578E7B07" fullword
217+
$ = "8B4E8278-525C-7343-B825-280AEBCD3BCB" fullword
218+
$ = "8DA62042-8B59-B4E3-D232-38B29A10964A" fullword
219+
$ = "907A2A79-7116-4CB6-9FA5-E5A58C4587CD" fullword
220+
$ = "921E2042-70D3-F9F1-8CBD-B398A21F89C6" fullword
221+
$ = "96BB3342-6335-0FA8-BA29-E1BA5D8FEFBE" fullword
222+
$ = "9921DE3A-5C1A-DF11-9078-563412000026" fullword
223+
$ = "9C6D1742-046D-BC94-ED09-C36F70CC9A91" fullword
224+
$ = "A15A930C-8251-9645-AF63-E45AD728C20C" fullword
225+
$ = "A7721742-BE24-8A1C-B859-D7F8251A83D3" fullword
226+
$ = "A9C83342-4800-0578-1EE8-BA26D2A678D2" fullword
227+
$ = "ACA69200-3C4C-11EA-8000-3CECEF4401AA" fullword
228+
$ = "ADEEEE9E-EF0A-6B84-B14B-B83A54AFC548" fullword
229+
$ = "AF1B2042-4B90-0000-A4E4-632A1C8C7EB1" fullword
230+
$ = "B1112042-52E8-E25B-3655-6A4F54155DBF" fullword
231+
$ = "B6464A2B-92C7-4B95-A2D0-E5410081B812" fullword
232+
$ = "BB233342-2E01-718F-D4A1-E7F69D026428" fullword
233+
$ = "BB64E044-87BA-C847-BC0A-C797D1A16A50" fullword
234+
$ = "BE784D56-81F5-2C8D-9D4B-5AB56F05D86E" fullword
235+
$ = "C249957A-AA08-4B21-933F-9271BEC63C85" fullword
236+
$ = "C6B32042-4EC3-6FDF-C725-6F63914DA7C7" fullword
237+
$ = "C7D23342-A5D4-68A1-59AC-CF40F735B363" fullword
238+
$ = "CC5B3F62-2A04-4D2E-A46C-AA41B7050712" fullword
239+
$ = "CE352E42-9339-8484-293A-BD50CDC639A5" fullword
240+
$ = "CEFC836C-8CB1-45A6-ADD7-209085EE2A57" fullword
241+
$ = "CF1BE00F-4AAF-455E-8DCD-B5B09B6BFA8F" fullword
242+
$ = "D2DC3342-396C-6737-A8F6-0C6673C1DE08" fullword
243+
$ = "D7382042-00A0-A6F0-1E51-FD1BBF06CD71" fullword
244+
$ = "D8C30328-1B06-4611-8E3C-E433F4F9794E" fullword
245+
$ = "D9142042-8F51-5EFF-D5F8-EE9AE3D1602A" fullword
246+
$ = "DBC22E42-59F7-1329-D9F2-E78A2EE5BD0D" fullword
247+
$ = "DBCC3514-FA57-477D-9D1F-1CAF4CC92D0F" fullword
248+
$ = "DD9C3342-FB80-9A31-EB04-5794E5AE2B4C" fullword
249+
$ = "DEAEB8CE-A573-9F48-BD40-62ED6C223F20" fullword
250+
$ = "E08DE9AA-C704-4261-B32D-57B2A3993518" fullword
251+
$ = "EADD1742-4807-00A0-F92E-CCD933E9D8C1" fullword
252+
$ = "EB16924B-FB6D-4FA1-8666-17B91F62FB37" fullword
253+
$ = "F5744000-3C78-11EA-8000-3CECEF43FEFE" fullword
254+
$ = "FA8C2042-205D-13B0-FCB5-C5CC55577A35" fullword
255+
$ = "FCE23342-91F1-EAFC-BA97-5AAE4509E173" fullword
256+
$ = "FE455D1A-BE27-4BA4-96C8-967A6D3A9661" fullword
257+
$ = "FED63342-E0D6-C669-D53F-253D696D74DA" fullword
258+
$ = "FF577B79-782E-0A4D-8568-B35A9B7EB76B" fullword
259+
260+
condition:
261+
2 of them
262+
}

‎rules/anti-behavior/blocklist/user.yara‎

Lines changed: 2 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
rule common_username_block_list: critical {
1+
rule common_username_block_list: high {
22
meta:
33
description = "avoids execution if user has a particular name"
44
ref = "https://www.zscaler.com/blogs/security-research/technical-analysis-bandit-stealer"
@@ -37,21 +37,6 @@ rule common_username_block_list: critical {
3737
$ = "test" fullword
3838
$ = "w0fjuOVmCcP5A" fullword
3939
40-
$not_grafana1 = "self.webpackChunkgrafana=self.webpackChunkgrafana||[]"
41-
$not_grafana2 = "The Grafana LLM plugin is not installed."
42-
$not_grafana3 = "grafana.debug.scenes"
43-
$not_jitsu = "jitsu.com"
44-
$not_redpanda = "redpanda"
45-
$not_sqlmetal1 = "sqlmetal"
46-
$not_sqlmetal2 = "asqlmetal_test_net_2_0, PublicKey=0024000004800000940000000602000000240000525341310004000001000100c5753d8c47f40083f549016a5711238ac8ec297605abccd3dc4b6d0f280b4764eb2cc58ec4e37831edad7e7a07b8fe4a9cbb059374c0cc047aa28839fed7176761813caf6a2ffa0bff9afb50ead56dd3f56186a663962a12b830c2a70eb70ec77823eb5750e5bdef9e01d097c30b5c5463c3d07d3472b58e4c02f2792309259f"
47-
$not_sqlmetal3 = "asqlmetal_test_net_4_0, PublicKey=0024000004800000940000000602000000240000525341310004000001000100c5753d8c47f40083f549016a5711238ac8ec297605abccd3dc4b6d0f280b4764eb2cc58ec4e37831edad7e7a07b8fe4a9cbb059374c0cc047aa28839fed7176761813caf6a2ffa0bff9afb50ead56dd3f56186a663962a12b830c2a70eb70ec77823eb5750e5bdef9e01d097c30b5c5463c3d07d3472b58e4c02f2792309259f"
48-
$not_wireshark = "wireshark.org"
49-
$gpt_tokenizer1 = "GPTTokenizer"
50-
$gpt_tokenizer2 = "GPT-4"
51-
$gpt_tokenizer3 = "const bpe = c0.concat();"
52-
$gpt_tokenizer4 = "const bpe = c0.concat(c1);"
53-
$gpt_tokenizer5 = "export default bpe;"
54-
5540
condition:
56-
8 of them and none of ($not*) and none of ($gpt_tokenizer*)
41+
12 of them
5742
}

‎rules/false_positives/faker.yara‎

Lines changed: 0 additions & 26 deletions
This file was deleted.

‎tests/javascript/clean/faker.js.simple‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
# javascript/clean/faker.js: medium
2-
anti-behavior/blocklist/user: low
32
anti-behavior/random_behavior: low
43
anti-static/obfuscation/js: medium
54
anti-static/obfuscation/math: medium

‎tests/javascript/clean/faker.min.js.simple‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
# javascript/clean/faker.min.js: medium
2-
anti-behavior/blocklist/user: low
32
anti-behavior/random_behavior: low
43
anti-static/obfuscation/js: medium
54
anti-static/obfuscation/obfuscate: low

‎tests/windows/2024.aspdasdksa2/creal.pyc.simple‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
3P/elastic/infostealer_wallets: critical
33
anti-behavior/blocklist/hostname: critical
44
anti-behavior/blocklist/mac_addr: critical
5-
anti-behavior/blocklist/user: critical
5+
anti-behavior/blocklist/user: high
66
anti-behavior/random_behavior: low
77
c2/addr/discord: medium
88
c2/addr/telegram: medium

0 commit comments

Comments
 (0)