chainguard-dev / bincapz

detect malicious program behaviors
Apache License 2.0
380 stars 24 forks source link

Add expected hashes to all MEDIUM+ rules, add YARA-CI #203

Closed tstromberg closed 2 months ago

tstromberg commented 2 months ago

In an effort to clean up bad rules, we're adding YARA-CI (see #183).

The way YARA-CI works is that rules have hashes they are expected to match. Many rules began with hashes, but since CI wasn't in place they were never checked. This PR resets the expected hashes for a clean start.