Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Improve findings for Mirai, vncjew, alfa, custom RAT #541

Merged
merged 8 commits into from
Oct 29, 2024
Merged

Improve findings for Mirai, vncjew, alfa, custom RAT #541

merged 8 commits into from
Oct 29, 2024

Conversation

tstromberg
Copy link
Collaborator

@tstromberg tstromberg commented Oct 25, 2024 •
edited
Loading

Also addresses more false-positives on Ubuntu discovered during rule development.

Related: chainguard-dev/malcontent-samples#20

@tstromberg tstromberg changed the title Add rules for Mirai, vncjew, alfa, custom RAT Improve findngs for Mirai, vncjew, alfa, custom RAT Oct 25, 2024
@tstromberg tstromberg requested a review from egibs October 25, 2024 13:13
@tstromberg tstromberg changed the title Improve findngs for Mirai, vncjew, alfa, custom RAT Improve findings for Mirai, vncjew, alfa, custom RAT Oct 25, 2024
@egibs
Copy link
Member

egibs commented Oct 28, 2024

FYI -- the tests are failing with:

--- FAIL: TestSimple/linux/2024.gas/gas (0.00s)
        samples_test.go:122: test program missing: linux/2024.gas/gas
            contents of linux/2024.gas:

@tstromberg
Copy link
Collaborator Author

FYI -- the tests are failing with:

--- FAIL: TestSimple/linux/2024.gas/gas (0.00s)
        samples_test.go:122: test program missing: linux/2024.gas/gas
            contents of linux/2024.gas:

it needs a samples update - will update PR now that the samples have been merged.

@tstromberg
Copy link
Collaborator Author

@egibs - PTAL

@tstromberg tstromberg enabled auto-merge (squash) October 29, 2024 00:53
@tstromberg tstromberg merged commit 6410f7c into chainguard-dev:main Oct 29, 2024
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@egibs egibs egibs approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@tstromberg @egibs