search

chainguard-dev / bincapz

detect malicious program behaviors
Apache License 2.0
404 stars 26 forks source link

critical false positive: 3P/godmoderules/iddqd/god/mode with ASP.net #130

Closed tstromberg closed 4 months ago

tstromberg commented 4 months ago

The aspnet packages trigger this YARA Forge rule:

## packages/x86_64/aspnet-6-runtime-6.0/usr/share/dotnet/shared/Microsoft.AspNetCore.App/6.0.29/Microsoft.Extensions.DependencyInjection.dll
## packages/x86_64/aspnet-6-targeting-pack-6.0/usr/share/dotnet/packs/Microsoft.AspNetCore.App.Ref/6.0.29/ref/net6.0/Microsoft.Extensions.DependencyInjection.dll
## packages/x86_64/aspnet-7-runtime-7.0/usr/share/dotnet/shared/Microsoft.AspNetCore.App/7.0.17/Microsoft.Extensions.DependencyInjection.dll
## packages/x86_64/aspnet-7-targeting-pack-7.0/usr/share/dotnet/packs/Microsoft.AspNetCore.App.Ref/7.0.17/ref/net7.0/Microsoft.Extensions.DependencyInjection.dll
## packages/x86_64/aspnet-8-runtime-8.0/usr/share/dotnet/shared/Microsoft.AspNetCore.App/8.0.4/Microsoft.Extensions.DependencyInjection.dll

Some of this rule overlaps with other rules in bincapz: we should split out the good non-overlapping ideas into our own ruleset, and make sure they don't raise a critical alert for asp.net.