chore(rules): 2026/04/15 FPR (#1470)

Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>

Author: egibs

rules/anti-static/obfuscation/padding.yara

@@ -14,6 +14,8 @@ rule msxml2_http: critical {
     $not_yui3     = "version: 2.6.0"
     $not_yui4     = "YAHOO.util.Connect={_msxml_progid:[\"Microsoft.XMLHTTP\",\"MSXML2.XMLHTTP.3.0\",\"MSXML2.XMLHTTP\"]"
     $not_yui5     = "if(typeof YAHOO==\"undefined\"||!YAHOO){var YAHOO={};}YAHOO.namespace=function()"
+    $not_dojo1    = "dojotoolkit.org"
+    $not_dojo2    = "dojo.xd.js"
 
   condition:
     filesize < 128KB and $a and !a > 32 and none of ($not*)

rules/evasion/mimicry/fake-process.yara

@@ -7,6 +7,7 @@ rule fake_kworker: critical linux {
     $kworker2 = "[kworker"
 
     $not_bpftrace_comment1 = " * 03:14:49 496    kworker/1:0H     md0"
+    $not_bpftrace_script   = "bpftrace" fullword
     $not_dockworker        = "dockworker/MS"
     $not_f2fs_h1           = "* fs/f2fs/f2fs.h"
     $not_f2fs_h2           = "#ifndef _LINUX_F2FS_H"

rules/exfil/stealer/wallet.yara

@@ -38,9 +38,12 @@ rule crypto_stealer_names: critical {
     $gpt_tokenizer3  = "const bpe = c0.concat();"
     $gpt_tokenizer4  = "const bpe = c0.concat(c1);"
     $gpt_tokenizer5  = "export default bpe;"
+    $bpe_tokenizer1  = "cl100k_base"
+    $bpe_tokenizer2  = "o200k_base"
+    $bpe_tokenizer3  = "p50k_base"
 
   condition:
-    filesize < 100MB and $http and 2 of ($w*) and none of ($not*) and none of ($gpt_tokenizer*)
+    filesize < 100MB and $http and 2 of ($w*) and none of ($not*) and none of ($gpt_tokenizer*) and none of ($bpe_tokenizer*)
 }
 
 rule crypto_extension_stealer: critical {

rules/false_positives/adminer.yara

@@ -0,0 +1,13 @@
+rule adminer_php: override {
+  meta:
+    description          = "adminer.php - legitimate database management tool"
+    webshell_adminer_4_7 = "harmless"
+
+  strings:
+    $adminer_header = "Adminer - Compact database management"
+    $adminer_org    = "https://www.adminer.org/"
+    $adminer_author = "Jakub Vrana"
+
+  condition:
+    filesize < 1MB and all of them
+}

rules/false_positives/crossplane.yara

@@ -0,0 +1,12 @@
+rule crossplane_aws_provider: override {
+  meta:
+    description              = "provider-aws-* crossplane-contrib/provider-upjet-aws Go binary"
+    RUSSIANPANDA_Mintsloader = "harmless"
+
+  strings:
+    $upjet_build = "crossplane-contrib/provider-upjet-aws/internal/version"
+    $upbound     = "github.com/upbound/provider-aws/v2"
+
+  condition:
+    filesize > 100MB and filesize < 1500MB and all of them
+}

rules/false_positives/datadog.yara

@@ -12,3 +12,21 @@ rule default_policy: override {
   condition:
     filesize < 256KB and all of them
 }
+
+rule datadog_agent_binary: override {
+  meta:
+    description               = "datadog-agent binary"
+    binary_url_with_question  = "medium"
+    iplookup_website          = "medium"
+    etc_ld_preload_not_ld     = "medium"
+    ipinfo_and_bash           = "medium"
+    linux_network_filter_exec = "medium"
+    go_memfd_create           = "medium"
+
+  strings:
+    $datadog_module = "github.com/DataDog/datadog-agent"
+    $datadoghq      = "datadoghq.com"
+
+  condition:
+    filesize < 500MB and all of them
+}

rules/false_positives/gemini_cli.yara

@@ -0,0 +1,17 @@
+rule gemini_cli_third_party: override {
+  meta:
+    description                 = "gemini-cli bundled third-party npm dependencies"
+    exotic_tld                  = "low"
+    iplookup_website            = "low"
+    browser_extension_installer = "low"
+    obfuscated_payload          = "low"
+    bash_persist                = "low"
+    bash_persist_persistent     = "low"
+
+  strings:
+    $gemini_module = "@google/gemini-cli"
+    $gemini_core   = "gemini-cli-core"
+
+  condition:
+    filesize < 100MB and all of them
+}

rules/false_positives/grub.yara

@@ -0,0 +1,11 @@
+rule grub_boot_images: override {
+  meta:
+    description     = "GRUB i386-pc boot images"
+    single_load_rwe = "medium"
+
+  strings:
+    $grub = "GRUB"
+
+  condition:
+    filesize < 64KB and $grub
+}

rules/false_positives/kuma.yara

@@ -0,0 +1,12 @@
+rule kuma_cp: override {
+  meta:
+    description  = "kuma-cp - Kuma service mesh control plane"
+    ESET_Kobalos = "harmless"
+
+  strings:
+    $kuma_module = "github.com/kumahq/kuma"
+    $kuma_io     = "kuma.io"
+
+  condition:
+    filesize < 250MB and all of them
+}

rules/false_positives/nltk.yara

@@ -0,0 +1,13 @@
+rule nltk_test_pathsec: override {
+  meta:
+    description                         = "nltk/test/unit/test_pathsec.py"
+    ELCEEF_Obfuscated_IP_Address_In_URL = "harmless"
+
+  strings:
+    $test_pathsec    = "test_pathsec"
+    $nltk_pathsec    = "nltk.pathsec"
+    $nltk_downloader = "nltk.downloader"
+
+  condition:
+    filesize < 64KB and all of them
+}