@dxworks/insider 2.9.1

package/dist/config/rules/components/load_dll.json

@@ -0,0 +1,66 @@
+[
+  {
+    "name": "Component: Windows DLL",
+    "id": "AI005400",
+    "description": "Component: Windows DLL",
+    "applies_to": [ "csharp" ],
+    "tags":[ "Component.Executable.SharedLibraryLoading" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "DllImport|Assembly\\.LoadFile|Assembly\\.LoadFrom",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Component: Windows DLL",
+    "id": "AI005500",
+    "description": "Component: Windows DLL",
+    "applies_to": [ "c", "cpp" ],
+    "tags":[ "Component.Executable.SharedLibraryLoading" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "LoadLibrary",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Component: Windows DLL",
+    "id": "AI005510",
+    "description": "Component: Windows DLL",
+    "applies_to": [ "rust" ],
+    "tags":[ "Component.Executable.SharedLibraryLoading" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "LoadLibrary|libloading|std::unstable::dynamic_lib::DynamicLibrary",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Component: Windows DLL",
+    "id": "AI005600",
+    "description": "Component: Windows DLL",
+    "applies_to": [ "python", "java" ],
+    "tags":[ "Component.Executable.SharedLibraryLoading" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "System\\.Load|ctypes\\.WinDLL",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  }
+]

package/dist/config/rules/cryptography/algorithm_implementation.json

@@ -0,0 +1,62 @@
+[
+  {
+    "name": "Cryptography: Algorithm Implementation (SHA1)",
+    "id": "AI005800",
+    "description": "Cryptography: Algorithm Implementation (SHA1)",
+    "tags":[ "Cryptography.Implementation.SHA1" ],
+    "severity": "important",
+    "patterns": [
+      {
+        "pattern": "5a827999",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: Algorithm Implementation (MD5)",
+    "id": "AI005900",
+    "description": "Cryptography: Algorithm Implementation (MD5)",
+    "tags":[ "Cryptography.Implementation.MD5" ],
+    "severity": "important",
+    "patterns": [
+      {
+        "pattern": "242070db",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: Algorithm Implementation (SHA-256)",
+    "id": "AI006000",
+    "description": "Cryptography: Algorithm Implementation (SHA-256)",
+    "tags":[ "Cryptography.Implementation.SHA256" ],
+    "severity": "important",
+    "patterns": [
+      {
+        "pattern": "d807aa98",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: Algorithm Implementation (Keccak)",
+    "id": "AI006100",
+    "description": "Cryptography: Algorithm Implementation (Keccak)",
+    "tags":[ "Cryptography.Implementation.SHA256" ],
+    "severity": "important",
+    "patterns": [
+      {
+        "pattern": "800000000000808A",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  }
+]

package/dist/config/rules/cryptography/certificate.json

@@ -0,0 +1,199 @@
+[
+  {
+    "name": "Cryptography: x.509 Certificate Use",
+    "id": "AI006200",
+    "description": "Cryptography: x.509 Certificate Use",
+    "tags":[ "Cryptography.X509Certificates.Use" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "x509|\\.(crt|cer|spc|p7b|p7s|p7r|ca-bundle)",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high",
+        "_comment": "do not include pfx or pem see rule below for x509 client auth"
+      },
+      {
+        "pattern": "PKCS|PaddingMode|SubjectIdentifier|Certificate",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "modifiers": [ "i" ]
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: x.509 Certificate Use",
+    "id": "AI006300",
+    "description": "Cryptography: x.509 Certificate Use",
+    "applies_to": [ "c", "cpp", "csharp" ],
+    "tags":[ "Cryptography.X509Certificates.Use" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "_CERT|CERT_",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: x.509 Certificate ClientAuth",
+    "id": "AI006400",
+    "description": "Cryptography: x.509 Certificate ClientAuth",
+    "tags": [
+      "Cryptography.X509Certificates.ClientAuth",
+      "Cryptography.X509Certificates.Keyfile"
+    ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "\\.(pem|pfx)",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high",
+        "_comment": "use for client auth is not guaranteed"
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: x.509 Certificate ClientAuth",
+    "id": "AI006410",
+    "description": "Cryptography: x.509 Certificate ClientAuth",
+    "tags":[ "Cryptography.X509Certificates.ClientAuth" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "\\.WithClientClaims\\(.*cert.*\\)|\\.WithCertificate\\(",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ],
+    "conditions": [
+      {
+        "pattern": {
+          "pattern": "AcquireTokenForClient|ConfidentialClientApplicationBuilder",
+          "type": "regexword",
+          "scopes": [ "code" ]
+        },
+        "search_in": "finding-region(-10,10)",
+        "negate_finding": false
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: x.509 Certificate Create",
+    "id": "AI006500",
+    "description": "Cryptography: x.509 Create Certificate",
+    "tags":[ "Cryptography.X509Certificates.Create" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "genrsa|-keyout|-x509toreq|csr",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "_comment": "Common OpenSSL commands"
+      },
+      {
+        "pattern": "---BEGIN CERTIFICATE---",
+        "type": "substring",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "---BEGIN PKCS",
+        "type": "substring",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "_comment": "allow for PKCS7, other"
+      },
+      {
+        "pattern": "(create|generate) (cert|certificate)",
+        "type": "regex",
+        "scopes": [
+          "comment"
+        ],
+        "confidence": "high",
+        "_comment": "Common OpenSSL commands or comments"
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: Digital Signature or DSA",
+    "id": "AI006600",
+    "description": "Cryptography: Digital Signature or DSA",
+    "applies_to":[ "csharp" ],
+    "tags":[ "Cryptography.Signing.Data" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "DSACng|SignData|CreateSignature|DSACryptoServiceProvider|DSASignatureDeformatter|DSASignatureFormatter|DSAKeyValue",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "DSAParameters",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: Digital Signature",
+    "id": "AI006700",
+    "description": "Cryptography: Digital Signature",
+    "tags":[ "Cryptography.Signing.Data" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "sign(ing)*.?key|signature.?key|valid.?signature|data.?sign|sign.?data",
+        "type": "regexword",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "DSA",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "low"
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: CodeSign",
+    "id": "AI006800",
+    "description": "Cryptography: CodeSign",
+    "tags":[ "Cryptography.Signing.Code" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "code.?sign|authenticode|sign.?code",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ],
+    "conditions": [
+      {
+        "pattern": {
+          "pattern": "shared access|SAS",
+          "type": "regexword",
+          "scopes": [ "code" ],
+          "modifiers": [ "i" ]
+        },
+        "search_in": "finding-region(-30,30)",
+        "negate_finding": true
+      }
+    ]
+  }
+]

package/dist/config/rules/cryptography/ciphers.json

@@ -0,0 +1,174 @@
+[
+  {
+    "name": "Cryptography: Encryption (AES)",
+    "id": "AI006900",
+    "description": "Cryptography: Encryption (AES)",
+    "tags":[ "Cryptography.Cipher.AES" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "AES",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "AES-?(128|192|256)|Rijndael",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: Encryption (3DES)",
+    "id": "AI007000",
+    "description": "Cryptography: Encryption (3DES)",
+    "tags":[ "Cryptography.Cipher.3DES" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "3DES|TripleDES",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: Encryption (RC)",
+    "id": "AI007100",
+    "description": "Cryptography: Encryption (RC)",
+    "tags":[ "Cryptography.Cipher.RC" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "RC([2456])",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "arc4random",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "modifiers": [ "i" ]
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: Encryption (Salsa20)",
+    "id": "AI007101",
+    "description": "Cryptography: Encryption (Salsa20)",
+    "tags":[ "Cryptography.Cipher.Salsa20" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "Salsa20",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "modifiers": [ "i" ]
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: Encryption (ChaCha)",
+    "id": "AI007102",
+    "description": "Cryptography: Encryption (ChaCha)",
+    "tags":[ "Cryptography.Cipher.ChaCha" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "ChaCha",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "modifiers": [ "i" ]
+      }
+    ]
+  },
+  {
+    "name": "Encryption: Cipher Mode",
+    "id": "AI007200",
+    "description": "Encryption: Cipher Mode",
+    "tags":[ "Cryptography.Cipher.CipherMode" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "CBC|CTR|ECB|OFB|CFB|CTS|PCBC|GMAC|XCBC|IACBC|IAPM|EAX|OCB|CWC|AEAD|LRW|XEX|XTS|CMC|EME|CBCMAC|OMAC|PMAC",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "low"
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: Encryption (RSA)",
+    "id": "AI007300",
+    "description": "Cryptography: Encryption",
+    "applies_to":[ "csharp" ],
+    "tags":[ "Cryptography.Cipher.RSA" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "RSACng|RSACryptoServiceProvider|RSAEncryptionPadding|RSAOAEPKeyExchangeDeformatter|X509AsymmetricSecurityKey",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "RSAOAEPKeyExchangeFormatter|RSAPKCS1KeyExchangeDeformatter|RSAPKCS1",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "RSASignaturePadding|RsaProtectedConfigurationProvider|RSACertificateExtensions",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: Encryption (RSA)",
+    "id": "AI007400",
+    "description": "Cryptography: Encryption",
+    "tags":[ "Cryptography.Cipher.RSA" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "RSA.*encrypt|RSA.*decrypt|public.?key|private.?key|privkey|pubkey",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "modifiers": [ "i" ]
+      },
+      {
+        "pattern": "rsa",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "low",
+        "modifiers": [ "i" ]
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: Encryption (General)",
+    "id": "AI007600",
+    "description": "Cryptography: Encryption",
+    "tags":[ "Cryptography.Encryption.General" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "encrypt|decrypt|cipher|crypt|symmmetric|asymmetric",
+        "type": "regex",
+        "scopes": [ "code", "comment" ],
+        "confidence": "medium",
+        "modifiers": [ "i" ]
+      }
+    ]
+  }
+]

package/dist/config/rules/cryptography/crypto_currency.json

@@ -0,0 +1,32 @@
+[
+  {
+    "name": "Cryptography: CryptoCurrency",
+    "id": "AI007700",
+    "description": "Cryptography: CryptoCurrency",
+    "tags":[ "Cryptography.CryptoCurrency" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "cardano|ethereum|cryptocurrency",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "p2pool|miner|ripple|nxt|zcash|tether|ether|btc|monero|merkleroot|xmr|eth",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "medium"
+      },
+      {
+        "pattern": "(bit|lite|name|peer|doge|grid|prim|vert|pot)coin",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  }
+]

package/dist/config/rules/cryptography/encoding.json

@@ -0,0 +1,20 @@
+[
+  {
+    "name": "Cryptography: Encoding (Base-64)",
+    "id": "AI007800",
+    "description": "Cryptography: Encoding (Base-64)",
+    "applies_to": [
+    ],
+    "tags":[ "Cryptography.Encoding.Base64" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "base64",
+        "type": "substring",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "modifiers": [ "i" ]
+      }
+    ]
+  }
+]