MalwareBehaviorCatalog follow-up: less naming stutter, less slashes (#…

…558)

* rule naming: avoid stutter, further MBC reorg

* update testdata

* run yr fmt

* keep the 3P subdir handling

* improve 3rd party rule keys

* renamed rules

* rename lvt to lvt_locker, remove obsolete false

* preserve anti-static

* move sus/plugin

* fix 3P rendering

---------

Co-authored-by: Evan Gibler <[email protected]>

capabilities.md

@@ -34,6 +34,7 @@ There are some internal namespaces we use:
 |---|---|
 | 3P | third party queries (unorganized) |
 | false-positives | rules to match known software |
-| sec-tool | known security tools (possibly dangerous) |
-| malware | known malware |
 | internal | other internal rules |
+| malware | known malware |
+| sec-tool | known security tools (possibly dangerous) |
+| sus | suspicious content that can't be otherwise categorized |

pkg/action/testdata/scan_archive

@@ -1,9 +1,11 @@
 # testdata/apko_nested.tar.gz ∴ /apko_0.13.2_linux_arm64/apko: high
 c2/addr/ip_port: medium
+c2/server_address: medium
 c2/tool_transfer/shell: medium
 collect/archives/zip: medium
-credential/keychain/keychain: medium
-credential/ssh/ssh: medium
+credential/keychain: medium
+credential/password: low
+credential/ssh: medium
 credential/ssl/private_key: low
 crypto/aes: low
 crypto/ecdsa: low
@@ -12,109 +14,107 @@ crypto/tls: low
 data/compression/bzip2: low
 data/compression/gzip: low
 data/compression/zstd: low
-data/embedded/embedded/pem/certificate: low
-data/embedded/embedded/pem/test_key: low
-data/embedded/embedded/ssh/signature: medium
-data/embedded/embedded/zstd: medium
+data/embedded/pem_certificate: low
+data/embedded/pem_test_key: low
+data/embedded/ssh_signature: medium
+data/embedded/zstd: medium
 data/encoding/base64: low
 data/encoding/json: low
-data/encoding/json/decode: low
-data/encoding/json/encode: low
+data/encoding/json_decode: low
+data/encoding/json_encode: low
 data/hash/blake2b: low
 data/hash/md5: low
-discover/network/interface/list: medium
-discover/network/mac/address: medium
+discover/network/interface_list: medium
+discover/network/mac_address: medium
 discover/network/netstat: medium
 discover/processes/pgrep: medium
-discover/system/cpu/info: low
-discover/system/hostname/get: low
+discover/system/cpu_info: low
+discover/system/hostname_get: low
 discover/system/platform: low
 discover/user/HOME: low
 discover/user/USER: low
-discover/user/username/get: medium
-evasion/bypass_security/linux/selinux: medium
+discover/user/name_get: medium
+evasion/bypass_security/linux/se: medium
 evasion/hidden_files/hidden: medium
 evasion/hide_artifacts/pivot_root: high
+exec/plugin: low
 exec/program: medium
-exec/shell/background/sleep: medium
+exec/shell/background_sleep: medium
 exec/shell/exec: medium
 fs/blkid: low
 fs/directory/create: low
 fs/directory/list: low
 fs/directory/remove: low
-fs/fifo/create: low
+fs/fifo_create: low
 fs/file/delete: low
-fs/file/delete/forcibly: low
+fs/file/delete_forcibly: low
 fs/file/read: low
 fs/file/stat: low
 fs/file/write: low
-fs/link/create: low
-fs/link/read: low
-fs/lock/update: low
+fs/link_create: low
+fs/link_read: low
+fs/lock_update: low
 fs/mount: low
-fs/node/create: low
-fs/path/bin/su: low
+fs/node_create: low
+fs/path/bin_su: low
 fs/path/etc: low
-fs/path/etc/hosts: medium
-fs/path/etc/resolv.conf: low
+fs/path/etc_hosts: medium
+fs/path/etc_resolv.conf: low
 fs/path/home: medium
-fs/path/home/config: low
+fs/path/home_config: low
 fs/path/relative: medium
 fs/path/root: medium
-fs/path/usr/bin: low
-fs/path/usr/local: medium
-fs/path/usr/sbin: low
+fs/path/usr_bin: low
+fs/path/usr_local: medium
+fs/path/usr_sbin: low
 fs/path/var: low
 fs/permission/chown: medium
 fs/permission/modify: medium
 fs/swap/off: low
 fs/swap/on: low
-fs/symlink/resolve: low
-fs/tempfile/create: low
+fs/symlink_resolve: low
+fs/tempdir/tempfile_create: low
 fs/unmount: low
-impact/words/exclamation: medium
-impact/words/heartbeat: medium
-impact/words/password: low
-impact/words/plugin: low
-impact/words/server_address: medium
-net/dns/dns: low
-net/dns/dns/reverse: medium
-net/dns/dns/servers: low
-net/dns/dns/txt: low
-net/download/download: medium
+impact/remote_access/heartbeat: medium
+net/dns: low
+net/dns/reverse: medium
+net/dns/servers: low
+net/dns/txt: low
+net/download: medium
 net/download/fetch: medium
-net/http/content/length/0: medium
-net/http/http/accept/encoding: low
-net/http/http/auth: low
-net/http/http/cookies: medium
-net/http/http/form/upload: medium
-net/http/http/post: medium
-net/http/http/request: low
-net/http/http2: low
-net/http/http_proxy: low
-net/ip/ip: low
-net/ip/ip/parse: medium
+net/http/2: low
+net/http/accept_encoding: low
+net/http/auth: low
+net/http/content_length_0: medium
+net/http/cookies: medium
+net/http/form_upload: medium
+net/http/post: medium
+net/http/proxy: low
+net/http/request: low
+net/ip: low
+net/ip/parse: medium
 net/proxy/socks5: medium
-net/resolve/hostname/resolve: low
-net/socket/socket/listen: low
-net/socket/socket/local_addr: low
-net/socket/socket/peer/address: low
-net/socket/socket/receive: low
-net/socket/socket/send: low
+net/resolve/hostname: low
+net/socket/listen: low
+net/socket/local_addr: low
+net/socket/peer_address: low
+net/socket/receive: low
+net/socket/send: low
 net/tcp/ssh: medium
-net/udp/udp/receive: low
-net/udp/udp/send: low
+net/udp/receive: low
+net/udp/send: low
 net/url/embedded: low
 net/url/encode: medium
 net/url/parse: low
 net/url/request: medium
 os/fd/sendfile: low
 os/kernel/netlink: low
-os/time/clock/set: low
-persist/cron/crontab: medium
-persist/daemon/daemon: medium
+os/time/clock_set: low
+persist/cron/tab: medium
+persist/daemon: medium
 process/chdir: low
 process/chroot: low
 process/executable_path: low
-process/groups/set: low
+process/groups_set: low
 process/unshare: low
+sus/exclamation: medium

pkg/action/testdata/scan_oci

@@ -1,17 +1,17 @@
 # testdata/static.tar.xz ∴ /etc/profile: medium
-fs/file/permission/mask/set: none
+fs/file/permission_mask_set: none
 fs/path/etc: low
 fs/path/usr: none
-fs/path/usr/local: medium
+fs/path/usr_local: medium
 persist/shell/bash: medium
 persist/shell/init_files: low
 # testdata/static.tar.xz ∴ /var/lib/db/sbom/ca-certificates-bundle-20240705-r0.spdx.json: medium
-net/download/download: medium
+net/download: medium
 net/url/embedded: low
 # testdata/static.tar.xz ∴ /var/lib/db/sbom/tzdata-2024b-r0.spdx.json: medium
-net/download/download: medium
+net/download: medium
 net/url/embedded: low
 os/time/tzinfo: low
 # testdata/static.tar.xz ∴ /var/lib/db/sbom/wolfi-baselayout-20230201-r15.spdx.json: medium
-net/download/download: medium
+net/download: medium
 net/url/embedded: low

pkg/report/report.go

@@ -44,32 +44,40 @@ var RiskLevels = map[int]string{
 
 // yaraForge has some very, very long rule names.
 var yaraForgeJunkWords = map[string]bool{
-	"controller":        true,
-	"generic":           true,
+	"0":                 true,
+	"1":                 true,
+	"2":                 true,
 	"apt":               true,
-	"malware":           true,
-	"YARAForge":         true,
-	"exe":               true,
-	"mal":               true,
-	"trojan":            true,
-	"m":                 true,
-	"hunting":           true,
-	"dynamic":           true,
+	"artefacts":         true,
+	"artifacts":         true,
+	"base":              true,
 	"big":               true,
-	"small":             true,
+	"controller":        true,
+	"dynamic":           true,
 	"encoded":           true,
+	"exe":               true,
+	"forensic":          true,
 	"forensicartifacts": true,
-	"lnx":               true,
+	"generic":           true,
+	"greyware":          true,
+	"hunting":           true,
+	"indicator":         true,
+	"keyword":           true,
 	"linux":             true,
+	"lnx":               true,
+	"m":                 true,
+	"mac":               true,
 	"macos":             true,
+	"mal":               true,
+	"malware":           true,
+	"offensive":         true,
 	"osx":               true,
-	"mac":               true,
-	"tool":              true,
-	"keyword":           true,
-	"indicator":         true,
+	"small":             true,
 	"suspicious":        true,
-	"offensive":         true,
-	"greyware":          true,
+	"tool":              true,
+	"trojan":            true,
+	"unix":              true,
+	"YARAForge":         true,
 }
 
 // thirdPartyCriticalSources are 3P sources that default to critical.
@@ -104,18 +112,18 @@ func thirdPartyKey(path string, rule string) string {
 	// include the directory
 	pathParts := strings.Split(path, "/")
 	subDir := pathParts[slices.Index(pathParts, "yara")+1]
-
 	words := []string{subDir}
 
 	// ELASTIC_Linux_Trojan_Gafgyt_E4A1982B
 	words = append(words, strings.Split(strings.ToLower(rule), "_")...)
 
-	// strip off the last wold if it's a hex key
+	// strip off the last word if it's a hex key
 	lastWord := words[len(words)-1]
 	_, err := strconv.ParseUint(lastWord, 16, 64)
 	if err == nil {
 		words = words[0 : len(words)-1]
 	}
+
 	var keepWords []string
 	for x, w := range words {
 		// ends with a date
@@ -134,8 +142,16 @@ func thirdPartyKey(path string, rule string) string {
 		keepWords = keepWords[0:4]
 	}
 
-	key := fmt.Sprintf("3P/%s", strings.Join(keepWords, "/"))
-	return strings.ReplaceAll(key, "signature/base", "signature_base")
+	src := keepWords[0]
+
+	// Fix name for https://github.com/Neo23x0/signature-base within YARAForge
+	if src == "signature" {
+		src = "sig_base"
+	}
+	rulename := keepWords[1:]
+
+	key := fmt.Sprintf("3P/%s/%s", src, strings.Join(rulename, "_"))
+	return key
 }
 
 // thirdParty returns whether the rule is sourced from a 3rd party.
@@ -153,8 +169,26 @@ func generateKey(src string, rule string) string {
 		return thirdPartyKey(src, rule)
 	}
 
-	key := strings.ReplaceAll(src, "-", "/")
-	return strings.ReplaceAll(key, ".yara", "")
+	key := strings.ReplaceAll(src, "-", "_")
+	key = strings.ReplaceAll(key, ".yara", "")
+
+	// Reduce stutter: if the rule is prefixed with the directory name, remove the prefix
+
+	dirParts := strings.Split(key, "/")
+	// ID's generally follow: `<namespace>/<resource>/<technique>`
+	ns := dirParts[0]
+	// namespaces can have dashes, like 'anti-static'
+	ns = strings.ReplaceAll(ns, "_", "-")
+	rsrc := dirParts[len(dirParts)-2]
+	tech := dirParts[len(dirParts)-1]
+
+	tech = strings.ReplaceAll(tech, rsrc, "")
+	tech = strings.ReplaceAll(tech, "__", "_")
+	tech = strings.Trim(tech, "_")
+
+	dirParts[0] = ns
+	dirParts[len(dirParts)-1] = tech
+	return strings.TrimSuffix(strings.Join(dirParts, "/"), "/")
 }
 
 func generateRuleURL(src string, rule string) string {

rules/false_positives/filebeat.yara

@@ -1,7 +1,7 @@
 rule misp_mdjson: override {
   meta:
     description = "misp_sample.mdjson.log"
-    lvt         = "medium"
+    lvt_locker  = "medium"
 
   strings:
     $attribute = "Attribute"