bugfix for base64 encoded arguments

panther-labs / panther-analysis

Built-in Panther detection rules and policies

https://panther.com/

Apache License 2.0

339 stars 173 forks source link

Closed arielkr256 closed 3 months ago

arielkr256 commented 3 months ago

is_base64 was generating some false positives for non-base64 strings

added validate=True to b64decode check to ensure decoded strings are not garbled https://stackoverflow.com/questions/2941995/python-ignore-incorrect-padding-error-when-base64-decoding
split command line arguments on quotes, '=', and spaces to account for quoted and prefixed base64 command line strings
added 3 new test cases

github-actions[bot] commented 3 months ago

:scream: looks like some things could be wrong with the packs

[INFO][root]: ignoring file dependabot.yml