tstromberg
commented
3 months ago Thanks! YARA rules are both fun and frustrating to write :)
I see that this PR is trying to do the right thing within YARA limitations. It's good, but I wanted to share a case where I think we can improve it. If a file contains /dev/null and /dev/stdin, this rule returns nothing:
echo "/dev/null /dev/shm/x /dev/stdin" > /tmp/test
yara -s -w rules/ref/path/dev.yara /tmp/testI don't know the best way to handle this case in yara: where you want to exclude a single result, but still allow other matches within a file. Looking at https://github.com/VirusTotal/yara/issues/1452 I'm not sure there is a native way to do this correctly in YARA.
My two suggestions:
- Leave this rule, but update the condition to matches if >1 /dev file is found:
$path and #path > 1 or (not dev_null and not dev_shm) - Add support to bincapz for a metadata field that lists results to exclude, for instance, "exclude_1 = "/dev/null"
I'm kind of siding toward the first option, but I think the second is an eventuality. Here's an example of a simplified version of your rule that I think delivers what you might be trying to achieve:
rule dev_path : notable {
meta:
description = "path reference within /dev"
strings:
$path = /\/dev\/[a-z\.\-\/]+/
$not_null = "/dev/null"
$not_shm = "/dev/shm/"
condition:
$path and #path > 1 or (none of ($not*))
}What do you think?
egibs
Closes: https://github.com/chainguard-dev/bincapz/issues/147
I wanted to try my hand at writing some YARA rules -- this PR adds a detection for
/dev/paths while excluding/dev/nulland/dev/shm/...since there are already detections for these two paths.I tested this with
$ go run . --oci python-- for example:There were a total of 139 matches for this rule in
python.