tstromberg
commented
6 days ago combo/stealer/creds
Most of the browser mentions come from this text:
Your user role supports directory sharing over desktop access, however this feature is only available by default on some Chromium based browsers like Google Chrome or Microsoft Edge. Brave users can use the feature by navigating to brave://flags/#file-system-access-api
The mention of Atomic is from things like go.uber.org/zap.AtomicLevel.Level - we can improve the rule to avoid some of this.
The mention of Discord is because there is Discord support in teleport.
ref/words/backdoor
We're going to have to look at the source code for this one - it's referencing a backdoor behavior which seems sketch.
ref/words/trojan
Same
/dev/tcp
Yeah, it uses it:
HOST=$1
PORT=$2
# check with nc
if check_exists nc; then
CONNECTIVITY_TEST_METHOD="nc"
if nc -z -w3 "${HOST}" "${PORT}" >/dev/null 2>&1; then return 0; else return 1; fi
# if there's no nc, check with telnet
elif check_exists telnet; then
CONNECTIVITY_TEST_METHOD="telnet"
if echo -e '\x1dclose\x0d' | telnet "${HOST}" "${PORT}" >/dev/null 2>&1; then return 0; else return 1; fi
# if there's no nc or telnet, try and use /dev/tcp
elif [ -f /dev/tcp ]; then
CONNECTIVITY_TEST_METHOD="/dev/tcp"
if (head -1 < "/dev/tcp/${HOST}/${PORT}") >/dev/null 2>&1; then return 0; else return 1; fi
else
return 255
fi
egibs
seen with teleport 16.0.3 - https://github.com/wolfi-dev/os/pull/22915
Many of these are legitimately bizarre high-risk behaviors, I do think the rules could be fine-tuned, particularly combo/stealer/creds and net/fetch/suspicious
I'm really curious about what some of these mentions are though!