Mass import not committing YARA rules
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 104
- Forks
- 17
- PR merge metrics
- No merged PRs in 30d
Description
Extracting YARA rules via https://threatkb.inquest.net/#!/import fails to commit.
Rule this was occurring on:
`rule SUSP_certificate_payload {
meta:
description = "Detects payloads that pretend to be certificates"
date = "2018/08/02"
author = "Didier Stevens, Florian Roth"
reference = "https://blog.nviso.be/2018/08/02/powershell-inside-a-certificate-part-3/"
score = 50
strings:
$re1 = "-----BEGIN CERTIFICATE-----"
$fp1 = "replace it with the PEM-encoded root certificate"
condition:
uint32(0) == 0x2D2D2D2D
and $re1 at 0
/* not 'M' at position 29, which is after the BEGIN CERTIFICATE header plus line break /
/ \r\n /
and not uint8(29) == 0x4D
/ \n /
and not uint8(28) == 0x4D
and not 1 of ($fp)
}`
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the failure through https://threatkb.inquest.net/#!/import using the supplied SUSP_certificate_payload YARA rule. Trace the mass-import path to find why the extracted rule is not committed; done means the rule imports successfully and is persisted for later use. No source files or tests are identified in the issue, so the relevant entry point must first be located.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100