InQuest / InQuest/ThreatKB

Mass import not committing YARA rules

Open
#440 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
104
Forks
17
PR merge metrics
No merged PRs in 30d

Description

Extracting YARA rules via https://threatkb.inquest.net/#!/import fails to commit.
Rule this was occurring on:
`rule SUSP_certificate_payload {
meta:
description = "Detects payloads that pretend to be certificates"
date = "2018/08/02"
author = "Didier Stevens, Florian Roth"
reference = "https://blog.nviso.be/2018/08/02/powershell-inside-a-certificate-part-3/"
score = 50
strings:
$re1 = "-----BEGIN CERTIFICATE-----"

  $fp1 = "replace it with the PEM-encoded root certificate"

condition:
uint32(0) == 0x2D2D2D2D
and $re1 at 0
/* not 'M' at position 29, which is after the BEGIN CERTIFICATE header plus line break /
/
\r\n /
and not uint8(29) == 0x4D
/
\n /
and not uint8(28) == 0x4D
and not 1 of ($fp
)
}`

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the failure through https://threatkb.inquest.net/#!/import using the supplied SUSP_certificate_payload YARA rule. Trace the mass-import path to find why the extracted rule is not committed; done means the rule imports successfully and is persisted for later use. No source files or tests are identified in the issue, so the relevant entry point must first be located.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.