Skip to content

fix: Reduce Malcontent JS False Positives #904

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
antitree merged 5 commits into from
May 8, 2025
Merged

fix: Reduce Malcontent JS False Positives #904

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
06f2843
fix(js): Reducing severity of javascript issues to reduce false posit…
antitree May 7, 2025
0908c57
Merge pull request #1 from antitree/malcontent-disable-js-obfs
antitree May 7, 2025
b8a0b8e
Fix: Dropping scope to only the most common false positive issues
antitree May 7, 2025
982f71d
fix: Updating test cases to reflect new scores
antitree May 7, 2025
fec6535
Update 002b815349c937aa5742a14d349dbc841c7348990e21a42fe7a503a5bfa562…
antitree May 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions rules/anti-static/obfuscation/js.yara
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,7 +83,7 @@ rule js_char_code_at_substitution: high {
obfs_probably_js and filesize < 256KB and all of them
}

rule child_process: critical {
rule child_process: high {
meta:
description = "obfuscated javascript that calls external programs"

Expand All @@ -101,7 +101,7 @@ rule child_process: critical {
obfs_probably_js and filesize < 1MB and all of them and math.entropy(1, filesize) >= 6
}

rule ebe: critical {
rule ebe: high {
meta:
description = "highly obfuscated javascript (eBe)"
filetypes = "javascript"
Expand Down Expand Up @@ -168,7 +168,7 @@ rule js_hex_eval_obfuscation: critical {
obfs_probably_js and filesize < 128KB and any of them
}

rule js_hex_obfuscation: critical {
rule js_hex_obfuscation: high {
meta:
description = "javascript function obfuscation (hex)"

Expand All @@ -188,7 +188,7 @@ rule high_entropy: medium {
obfs_probably_js and math.entropy(1, filesize) >= 6
}

rule very_high_entropy: critical {
rule very_high_entropy: high {
meta:
description = "very high entropy javascript (>7)"

Expand Down
2 changes: 1 addition & 1 deletion tests/javascript/2024.xmlrpc/validator.js.simple
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# javascript/2024.xmlrpc/validator.js: critical
anti-static/obfuscation/bool: medium
anti-static/obfuscation/hex: medium
anti-static/obfuscation/js: critical
anti-static/obfuscation/js: high
anti-static/obfuscation/strtoi: medium
c2/addr/url: medium
c2/client: medium
Expand Down
2 changes: 1 addition & 1 deletion tests/npm/2024.discord-api-ts/postinstall.js.simple
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
anti-behavior/random_behavior: low
anti-static/obfuscation/bool: medium
anti-static/obfuscation/hex: medium
anti-static/obfuscation/js: critical
anti-static/obfuscation/js: high
anti-static/obfuscation/strtoi: medium
c2/addr/url: medium
data/encoding/int: medium
Expand Down
2 changes: 1 addition & 1 deletion tests/npm/2024.nvmfix/config.js.simple
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# npm/2024.nvmfix/config.js: critical
anti-static/obfuscation/hex: medium
anti-static/obfuscation/js: critical
anti-static/obfuscation/js: high
c2/addr/url: medium
data/encoding/utf16: medium
process/create: medium
2 changes: 1 addition & 1 deletion tests/npm/2024.testerrrrrrrrrr/init.js.simple
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# npm/2024.testerrrrrrrrrr/init.js: critical
anti-static/obfuscation/bool: medium
anti-static/obfuscation/hex: medium
anti-static/obfuscation/js: critical
anti-static/obfuscation/js: high
anti-static/obfuscation/url: critical
c2/addr/server: medium
c2/addr/url: medium
Expand Down