Merge pull request #43 from tstromberg/main

Make output more concise
chainguard-dev · Mar 9, 2024 · 6b60c7d · 6b60c7d
2 parents 0450e12 + 905377e
commit 6b60c7d
Show file tree

Hide file tree

Showing 25 changed files with 29 additions and 13 deletions.
diff --git a/pkg/bincapz/render.go b/pkg/bincapz/render.go
@@ -25,6 +25,7 @@ func forceWrap(s string, x int) string {
 	fw := []string{}
 	for _, w := range words {
 		if len(w) > x-2 {
+			klog.Infof("wrapping %s - longer than %d", w, x-2)
 			w = w[0:x-2] + ".."
 		}
 		fw = append(fw, w)
@@ -85,19 +86,21 @@ func RenderTable(fr *FileReport, w io.Writer) {
 		data = append(data, []string{"", "", "", ""})
 	}
 
-	valWidth := 24
 	width := terminalWidth()
-	if width > 110 {
-		valWidth += (width - 110)
+	valWidth := 8
+
+	if width > 90 {
+		valWidth = (width - 90)
 	}
+
 	if valWidth > 65 {
 		valWidth = 65
 	}
 
 	klog.Infof("terminal width: %d / val width: %d", width, valWidth)
 
 	for _, k := range kbs {
-		val := strings.Join(k.Behavior.Strings, "|||")
+		val := strings.Join(k.Behavior.Strings, "\n")
 		val = forceWrap(val, valWidth)
 		val = strings.ReplaceAll(val, "|||", "\n")
 
@@ -114,15 +117,15 @@ func RenderTable(fr *FileReport, w io.Writer) {
 			}
 		}
 
-		words, _ := tablewriter.WrapString(desc, 52)
+		words, _ := tablewriter.WrapString(desc, 40)
 		desc = strings.Join(words, "\n")
 
 		data = append(data, []string{fmt.Sprintf("%d/%s", k.Behavior.RiskScore, k.Behavior.RiskLevel), k.Key, val, desc})
 	}
 	table := tablewriter.NewWriter(os.Stdout)
 	table.SetAutoWrapText(false)
 	table.SetHeader([]string{"Risk", "Key", "Values", "Description"})
-	//table.SetBorder(false)
+	table.SetBorder(false)
 	for _, d := range data {
 		if strings.Contains(d[0], "LOW") {
 			table.Rich(d, []tablewriter.Colors{tablewriter.Colors{tablewriter.Normal, tablewriter.FgGreenColor}})

diff --git a/pkg/bincapz/report.go b/pkg/bincapz/report.go
@@ -64,6 +64,7 @@ var yaraForgeJunkWords = map[string]bool{
 	"encoded":           true,
 	"forensicartifacts": true,
 	"lnx":               true,
+	"linux":             true,
 }
 
 var dateRe = regexp.MustCompile(`[a-z]{3}\d{1,2}`)

diff --git a/...o/backdoor/macos/alert_socket_getpid.yara → ...s/combo/backdoor/alert_socket_getpid.yara b/...o/backdoor/macos/alert_socket_getpid.yara → ...s/combo/backdoor/alert_socket_getpid.yara
diff --git a/...bo/backdoor/macos/debug_post_execute.yara → rules/combo/backdoor/debug_post_execute.yara b/...bo/backdoor/macos/debug_post_execute.yara → rules/combo/backdoor/debug_post_execute.yara
diff --git a/...mbo/backdoor/macos/dlsym_and_openpty.yara → rules/combo/backdoor/dlsym_and_openpty.yara b/...mbo/backdoor/macos/dlsym_and_openpty.yara → rules/combo/backdoor/dlsym_and_openpty.yara
diff --git a/...bo/backdoor/macos/dlsym_pthread_exec.yara → rules/combo/backdoor/dlsym_pthread_exec.yara b/...bo/backdoor/macos/dlsym_pthread_exec.yara → rules/combo/backdoor/dlsym_pthread_exec.yara
diff --git a/...kdoor/macos/exec_getprogname_waitpid.yara → ...bo/backdoor/exec_getprogname_waitpid.yara b/...kdoor/macos/exec_getprogname_waitpid.yara → ...bo/backdoor/exec_getprogname_waitpid.yara
diff --git a/...bo/backdoor/macos/hostinfo_collector.yara → rules/combo/backdoor/hostinfo_collector.yara b/...bo/backdoor/macos/hostinfo_collector.yara → rules/combo/backdoor/hostinfo_collector.yara
diff --git a/...bo/backdoor/macos/ioplatform_sketchy.yara → rules/combo/backdoor/ioplatform_sketchy.yara b/...bo/backdoor/macos/ioplatform_sketchy.yara → rules/combo/backdoor/ioplatform_sketchy.yara
diff --git a/...bo/backdoor/linux/iptables_gdns_http.yara → rules/combo/backdoor/iptables_gdns_http.yara b/...bo/backdoor/linux/iptables_gdns_http.yara → rules/combo/backdoor/iptables_gdns_http.yara
diff --git a/rules/combo/backdoor/linux/iptables_ssh.yara → rules/combo/backdoor/iptables_ssh.yara b/rules/combo/backdoor/linux/iptables_ssh.yara → rules/combo/backdoor/iptables_ssh.yara
diff --git a/.../backdoor/linux/iptables_upload_http.yara → .../combo/backdoor/iptables_upload_http.yara b/.../backdoor/linux/iptables_upload_http.yara → .../combo/backdoor/iptables_upload_http.yara
diff --git a/.../backdoor/linux/listen_terminal_exec.yara → .../combo/backdoor/listen_terminal_exec.yara b/.../backdoor/linux/listen_terminal_exec.yara → .../combo/backdoor/listen_terminal_exec.yara
diff --git a/...ombo/backdoor/macos/listpids_libcurl.yara → rules/combo/backdoor/listpids_libcurl.yara b/...ombo/backdoor/macos/listpids_libcurl.yara → rules/combo/backdoor/listpids_libcurl.yara
diff --git a/...bo/backdoor/macos/macos_kitchen_sink.yara → rules/combo/backdoor/macos_kitchen_sink.yara b/...bo/backdoor/macos/macos_kitchen_sink.yara → rules/combo/backdoor/macos_kitchen_sink.yara
diff --git a/...backdoor/linux/multiple_sys_commands.yara → ...combo/backdoor/multiple_sys_commands.yara b/...backdoor/linux/multiple_sys_commands.yara → ...combo/backdoor/multiple_sys_commands.yara
diff --git a/...ombo/backdoor/linux/selinux_firewall.yara → rules/combo/backdoor/selinux_firewall.yara b/...ombo/backdoor/linux/selinux_firewall.yara → rules/combo/backdoor/selinux_firewall.yara
diff --git a/.../backdoor/linux/sensitive_linux_logs.yara → rules/combo/backdoor/sensitive_logs.yara b/.../backdoor/linux/sensitive_linux_logs.yara → rules/combo/backdoor/sensitive_logs.yara
@@ -1,5 +1,4 @@
-
-rule system_log_references {
+rule system_log_references : suspicious {
   meta:
 	description = "Accesses multiple sensitive Linux logs"
   strings:

diff --git a/...combo/backdoor/macos/sw_vers_libcurl.yara → rules/combo/backdoor/sw_vers_libcurl.yara b/...combo/backdoor/macos/sw_vers_libcurl.yara → rules/combo/backdoor/sw_vers_libcurl.yara
diff --git a/...oor/linux/system_write_geteuid_sleep.yara → .../backdoor/system_write_geteuid_sleep.yara b/...oor/linux/system_write_geteuid_sleep.yara → .../backdoor/system_write_geteuid_sleep.yara
diff --git a/rules/combo/worm/ssh.yara b/rules/combo/worm/ssh.yara
@@ -1,6 +1,6 @@
-rule generic_scan_tool : critical {
+rule generic_scan_tool : suspicious {
   meta:
-	description = "Probably an SSH worm, like SSH-Snake"
+	description = "possible SSH worm like SSH-Snake"
   strings:
 	$s_dot_ssh = ".ssh"
 	$s_authorized_keys = "authorized_keys"

diff --git a/rules/data/embedded-pem-private_key.yara b/rules/data/embedded-pem-private_key.yara
@@ -1,4 +1,4 @@
-rule begin_key {
+rule begin_private_key : notable {
 	meta:
 		description = "Contains PRIVATE KEY directive"
 	strings:
@@ -7,4 +7,15 @@ rule begin_key {
 		any of them
 }
 
+rule rsa_private_key : notable {
+	meta:
+		description = "Contains RSA PRIVATE KEY directive"
+	strings:
+		$ref = "RSA PRIVATE KEY-----"
+	condition:
+		any of them
+}
+
+
+
 
diff --git a/rules/data/embedded-ssh-key.yara b/rules/data/embedded-ssh-key.yara
@@ -1,5 +1,6 @@
-rule ssh_pubilc_key : suspicious {
+rule ssh_public_key : suspicious {
 	meta:
+		description = "contains SSH public key"
 	    ref = "https://unfinished.bike/qubitstrike-and-diamorphine-linux-kernel-rootkits-go-mainstream"
 	strings:
 	    $ssh_rsa = /ssh-[dr]sa [\w\+\/\=]{0,1024} [\w\-\.]{0,32}\@[\w\.\-]{1,64}/

diff --git a/rules/ref/email.yara b/rules/ref/email.yara
@@ -1,4 +1,4 @@
-rule email_addr {
+rule email_addr : harmless {
   meta:
 	description = "Contains an email address"
   strings:

diff --git a/rules/techniques/code_eval.yara b/rules/techniques/code_eval.yara
@@ -6,3 +6,4 @@ rule eval : suspicious {
 	condition:
 		any of them
 }
+
Original file line number	Diff line number	Diff line change
Expand Up		@@ -6,3 +6,4 @@ rule eval : suspicious {
		condition:
		any of them
		}