diff --git a/rules/anti-static/obfuscation/js.yara b/rules/anti-static/obfuscation/js.yara index 54570de07..8a73fd0e2 100644 --- a/rules/anti-static/obfuscation/js.yara +++ b/rules/anti-static/obfuscation/js.yara @@ -83,7 +83,7 @@ rule js_char_code_at_substitution: high { obfs_probably_js and filesize < 256KB and all of them } -rule child_process: critical { +rule child_process: high { meta: description = "obfuscated javascript that calls external programs" @@ -101,7 +101,7 @@ rule child_process: critical { obfs_probably_js and filesize < 1MB and all of them and math.entropy(1, filesize) >= 6 } -rule ebe: critical { +rule ebe: high { meta: description = "highly obfuscated javascript (eBe)" filetypes = "javascript" @@ -168,7 +168,7 @@ rule js_hex_eval_obfuscation: critical { obfs_probably_js and filesize < 128KB and any of them } -rule js_hex_obfuscation: critical { +rule js_hex_obfuscation: high { meta: description = "javascript function obfuscation (hex)" @@ -188,7 +188,7 @@ rule high_entropy: medium { obfs_probably_js and math.entropy(1, filesize) >= 6 } -rule very_high_entropy: critical { +rule very_high_entropy: high { meta: description = "very high entropy javascript (>7)" diff --git a/tests/javascript/2024.xmlrpc/validator.js.simple b/tests/javascript/2024.xmlrpc/validator.js.simple index 5c1104b04..ecf454380 100644 --- a/tests/javascript/2024.xmlrpc/validator.js.simple +++ b/tests/javascript/2024.xmlrpc/validator.js.simple @@ -1,7 +1,7 @@ # javascript/2024.xmlrpc/validator.js: critical anti-static/obfuscation/bool: medium anti-static/obfuscation/hex: medium -anti-static/obfuscation/js: critical +anti-static/obfuscation/js: high anti-static/obfuscation/strtoi: medium c2/addr/url: medium c2/client: medium diff --git a/tests/npm/2024.discord-api-ts/postinstall.js.simple b/tests/npm/2024.discord-api-ts/postinstall.js.simple index 2f227b487..742c7b541 100644 --- a/tests/npm/2024.discord-api-ts/postinstall.js.simple +++ b/tests/npm/2024.discord-api-ts/postinstall.js.simple @@ -2,7 +2,7 @@ anti-behavior/random_behavior: low anti-static/obfuscation/bool: medium anti-static/obfuscation/hex: medium -anti-static/obfuscation/js: critical +anti-static/obfuscation/js: high anti-static/obfuscation/strtoi: medium c2/addr/url: medium data/encoding/int: medium diff --git a/tests/npm/2024.nvmfix/config.js.simple b/tests/npm/2024.nvmfix/config.js.simple index 0c84fab92..0b095708c 100644 --- a/tests/npm/2024.nvmfix/config.js.simple +++ b/tests/npm/2024.nvmfix/config.js.simple @@ -1,6 +1,6 @@ # npm/2024.nvmfix/config.js: critical anti-static/obfuscation/hex: medium -anti-static/obfuscation/js: critical +anti-static/obfuscation/js: high c2/addr/url: medium data/encoding/utf16: medium process/create: medium diff --git a/tests/npm/2024.testerrrrrrrrrr/init.js.simple b/tests/npm/2024.testerrrrrrrrrr/init.js.simple index b045a6a80..a0595c44c 100644 --- a/tests/npm/2024.testerrrrrrrrrr/init.js.simple +++ b/tests/npm/2024.testerrrrrrrrrr/init.js.simple @@ -1,7 +1,7 @@ # npm/2024.testerrrrrrrrrr/init.js: critical anti-static/obfuscation/bool: medium anti-static/obfuscation/hex: medium -anti-static/obfuscation/js: critical +anti-static/obfuscation/js: high anti-static/obfuscation/url: critical c2/addr/server: medium c2/addr/url: medium