Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: prevent detection of web shells rules as malware by Windows Defender (955260 PL1) #3687

Merged
merged 11 commits into from
May 18, 2024

Conversation

azurit
Copy link
Member

@azurit azurit commented Apr 29, 2024

Windows Defender is detecting pattern <title>Ru24PostWebShell - as Backdoor:PHP/Dirtelti.MTJ. This PR prevents it by removing - from the end of the pattern.

Fixes #3603.

Copy link
Contributor

@theseion theseion left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks ok, but we don't yet have tests for this rule. Could you add one or two?

fzipi
fzipi previously approved these changes May 11, 2024
Copy link
Member

@fzipi fzipi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@fzipi fzipi self-requested a review May 11, 2024 14:13
@Xhoenix Xhoenix enabled auto-merge May 13, 2024 13:49
@Xhoenix Xhoenix disabled auto-merge May 13, 2024 13:49
@azurit
Copy link
Member Author

azurit commented May 14, 2024

@theseion @fzipi Any hints on how to force a test to output a string with new lines?

@theseion
Copy link
Contributor

Use encoded_request and pass the payload as base64 encoded string. That ensures that you carriage returns don't get lost as well.

@azurit
Copy link
Member Author

azurit commented May 14, 2024

Use encoded_request and pass the payload as base64 encoded string. That ensures that you carriage returns don't get lost as well.

This is for creating a request but i need to create a response.

@theseion
Copy link
Contributor

We don't yet have a facility to mock responses. However, because responses are reflected we can use the request to inject at least part of the response. I quickly tested the test you wrote and the response does contain the newlines you sent in the request (pass --trace to go-ftw to see the response).

@azurit
Copy link
Member Author

azurit commented May 15, 2024

But test haven't pass, so something is wrong. Maybe it outputed \r\n instead of \n, which regex expects?

@theseion
Copy link
Contributor

There are two problems:

  1. the expected response is embedded, so the response body will never match ^....
  2. line breaks are returned as literal \n sequences

We need to have a built-in facility in go-ftw for this, unfortunately.

@azurit
Copy link
Member Author

azurit commented May 15, 2024

So, is it currently possible to write a test for that rule?

@theseion
Copy link
Contributor

No, it currently isn't possible. I would still like to keep your test. Just set enabled: false and add to the description that we cannot currently run this test with the setup we have.

@azurit azurit requested a review from theseion May 16, 2024 07:45
@azurit azurit requested review from Xhoenix and removed request for fzipi May 17, 2024 06:31
@azurit azurit added this pull request to the merge queue May 18, 2024
@azurit
Copy link
Member Author

azurit commented May 18, 2024

@theseion Thank you!

Merged via the queue into coreruleset:main with commit 26ddcfc May 18, 2024
4 checks passed
@azurit azurit deleted the WebShells branch May 18, 2024 14:56
@dune73
Copy link
Member

dune73 commented May 18, 2024

Glad this made the cut.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Windows defender flagging RESPONSE-955-WEB-SHELLS.conf as malware Backdoor:PHP/Dirtelti.MTJ
5 participants