@dxworks/insider 2.9.1

package/dist/config/rules/os/file_io.json

@@ -0,0 +1,468 @@
+[
+  {
+    "name": "File Operation (Read)",
+    "id": "AI035600",
+    "description": "File Operation",
+    "applies_to": [
+      "c",
+      "cpp"
+    ],
+    "tags":[ "OS.FileOperation.Read" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "ifstream|fread|fgets|fgetc",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "File Operation (Read)",
+    "id": "AI035700",
+    "description": "File Operation (Read)",
+    "applies_to":[ "csharp" ],
+    "tags":[ "OS.FileOperation.Read" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "File.Read",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "new FileStream",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "File.OpenText",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "File Operation (Read)",
+    "id": "AI035800",
+    "description": "File Operation (Read)",
+    "applies_to":[ "python" ],
+    "tags":[ "OS.FileOperation.Read" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "open\\(.*,.*r.*\\);",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": ".readlines(",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": ".read(",
+        "type": "string",
+        "scopes": [ "code" ]
+      }
+    ]
+  },
+  {
+    "name": "File Operation (Read)",
+    "id": "AI035900",
+    "description": "File Operation (Read)",
+    "applies_to":[ "javascript" ],
+    "tags":[ "OS.FileOperation.Read" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "fs.read",
+        "type": "string",
+        "scopes": [ "code" ]
+      },
+      {
+        "pattern": "fs.ReadStream",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "fs.open",
+        "type": "string",
+        "scopes": [ "code" ]
+      }
+    ]
+  },
+  {
+    "name": "File Operation (Read)",
+    "id": "AI035910",
+    "description": "File Operation",
+    "applies_to":[ "java" ],
+    "tags":[ "OS.FileOperation.Read" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "new BufferedReader(new FileReader",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "FileReader|new Scanner\\(Files\\.readAllLines|Files\\.readAllBytes|FileInputStream",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "File Operation (Read)",
+    "id": "AI035911",
+    "description": "File Operation",
+    "applies_to":[ "rust" ],
+    "tags":[ "OS.FileOperation.Read" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "BufRead|File::open|read_to_string|read_to_end|\\.read",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "FileReader|new Scanner\\(Files\\.readAllLines|Files\\.readAllBytes|FileInputStream",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "File Operation (Delete)",
+    "id": "AI036000",
+    "description": "File Operation (Delete)",
+    "applies_to": [ "c", "cpp" ],
+    "tags":[ "OS.FileOperation.Delete" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "\\b(std::)?remove\\(.+\\)",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "remove",
+        "type": "string",
+        "scopes": [ "code" ]
+      }
+    ],
+    "conditions": [
+      {
+        "pattern": {
+          "pattern": "include <(fstream|stdio|iostream)",
+          "type": "regex",
+          "scopes": [ "code" ]
+        },
+        "search_in": "finding-region(-200,1)",
+        "negate_finding": false
+      }
+    ]
+  },
+  {
+    "name": "File Operation (Delete)",
+    "id": "AI036010",
+    "description": "File Operation (Delete)",
+    "applies_to":[ "rust" ],
+    "tags":[ "OS.FileOperation.Delete" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "remove_file",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "File Operation (Delete)",
+    "id": "AI036100",
+    "description": "File Operation (Delete)",
+    "applies_to":[ "python" ],
+    "tags":[ "OS.FileOperation.Delete" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "os.remove(",
+        "type": "substring",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "os.ulink(",
+        "type": "substring",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "File Operation (Delete)",
+    "id": "AI036200",
+    "description": "File Operation (Delete)",
+    "applies_to":[ "csharp" ],
+    "tags":[ "OS.FileOperation.Delete" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "File.Delete",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "File Operation (Delete)",
+    "id": "AI036300",
+    "description": "File Operation (Delete)",
+    "applies_to":[ "java" ],
+    "tags":[ "OS.FileOperation.Delete" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "file.delete(",
+        "type": "substring",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "modifiers": [ "i" ]
+      }
+    ]
+  },
+  {
+    "name": "File Operation (Delete)",
+    "id": "AI036400",
+    "description": "File Operation (Delete)",
+    "applies_to":[ "javascript" ],
+    "tags":[ "OS.FileOperation.Delete" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": ".unlink(Sync)?\\(",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "fs.remove(",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "File Operation (Write)",
+    "id": "AI036500",
+    "description": "File Operation (Write)",
+    "applies_to":[ "csharp" ],
+    "tags":[ "OS.FileOperation.Write" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "File\\.WriteAllText|File\\.AppendText",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "StreamWriter",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "File Operation (Write)",
+    "id": "AI036501",
+    "description": "File Operation (Write)",
+    "applies_to":[ "csharp" ],
+    "tags":[ "OS.FileOperation.Write" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "StreamWriter",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ],
+    "conditions": [
+      {
+        "pattern": {
+          "pattern": "FileStream",
+          "type": "string",
+          "scopes": [ "code" ]
+        },
+        "search_in": "finding-region(-10,0)",
+        "negate_finding": false
+      }
+    ]
+  },  
+  {
+    "name": "File Operation (Write)",
+    "id": "AI036600",
+    "description": "File Operation (Write)",
+    "applies_to": [
+      "c",
+      "cpp"
+    ],
+    "tags":[ "OS.FileOperation.Write" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "fstream|fwrite|fprintf|sprintf|fput",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "fopen\\(.*,.*w.*\\);",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "_comment": "write"
+      },
+      {
+        "pattern": "fopen\\(.*,.*a.*\\);",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "_comment": "append"
+      },
+      {
+        "pattern": "writefile|copyfile|filesystem::copy|std::ios_base::app",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "File Operation (Write)",
+    "id": "AI036610",
+    "description": "File Operation (Write)",
+    "applies_to":[ "python" ],
+    "tags":[ "OS.FileOperation.Write" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": ".write(",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "open\\(.*,.*w.*\\);",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "_comment": "write"
+      },
+      {
+        "pattern": "open\\(.*,.*a.*\\);",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "_comment": "append"
+      }
+    ]
+  },
+  {
+    "name": "File Operation (Write)",
+    "id": "AI036620",
+    "description": "File Operation (Write)",
+    "applies_to":[ "javascript" ],
+    "tags":[ "OS.FileOperation.Write" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "fs.write",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "WriteStream|appendFile|copyFile|createWriteStream|ftruncate",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "FileWriter|BufferedWriter|FileUtils\\.copyFile|Files\\.copy",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "File Operation (Write)",
+    "id": "AI036621",
+    "description": "File Operation (Write)",
+    "applies_to":[ "rust" ],
+    "tags":[ "OS.FileOperation.Write" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "File::create|use std::io::Write|BufWriter::new",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "File Operation (Write)",
+    "id": "AI036622",
+    "description": "File Operation (Write)",
+    "applies_to":[ "rust" ],
+    "tags":[ "OS.FileOperation.Write" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "\\.write_all|\\.write_fmt",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "write",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "low"
+      }
+    ],
+    "conditions": [
+      {
+        "pattern": {
+          "pattern": "use std::io::Write|use std::io::File|use std:fs:File",
+          "type": "regexword",
+          "scopes": [ "code" ],
+          "modifiers": [ "i" ]
+        },
+        "search_in": "finding-region(-240,240)",
+        "negate_finding": false
+      }
+    ]
+  }
+]

package/dist/config/rules/os/process.json

@@ -0,0 +1,179 @@
+[
+  {
+    "name": "OS: Multiprocessing / Multithreading",
+    "id": "AI036700",
+    "description": "OS: Multiprocessing / Multithreading",
+    "tags":[ "OS.Process.Multiprocessing" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "mutex|semaphore|thread|lock|fork",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "async|await",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "medium"
+      }
+    ]
+  },
+  {
+    "name": "OS: Multiprocessing / Multithreading",
+    "id": "AI036800",
+    "description": "OS: Multiprocessing / Multithreading",
+    "applies_to": [
+      "c",
+      "cpp"
+    ],
+    "tags":[ "OS.Process.Multiprocessing" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "WaitForSingleObject|WaitForMultipleObjects",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "OS: Multiprocessing / Multithreading",
+    "id": "AI036900",
+    "description": "OS: Multiprocessing / Multithreading",
+    "applies_to":[ "csharp" ],
+    "tags":[ "OS.Process.Multiprocessing" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "BackgroundWorker|Task\\.Run|Async|System.Threading",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "(new System\\.Diagnostics.Process\\(\\)| new Process\\(\\))",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "OS: Multiprocessing / Multithreading",
+    "id": "AI036910",
+    "description": "OS: Multiprocessing / Multithreading",
+    "applies_to":[ "rust" ],
+    "tags":[ "OS.Process.Multiprocessing" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "thread::spawn",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "(new System\\.Diagnostics.Process\\(\\)| new Process\\(\\))",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "OS: Multiprocessing / Multithreading",
+    "id": "AI037000",
+    "description": "OS: Multiprocessing / Multithreading",
+    "applies_to":[ "java" ],
+    "tags":[ "OS.Process.Multiprocessing" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "Runnable",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "OS: Multiprocessing / Multithreading",
+    "id": "AI037100",
+    "description": "OS: Multiprocessing / Multithreading",
+    "applies_to":[ "go" ],
+    "tags":[ "OS.Process.Multiprocessing" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "<-",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "OS: Process Access (Read)",
+    "id": "AI037200",
+    "description": "OS: Process Access (Read)",
+    "applies_to": [
+      "c",
+      "cpp",
+      "csharp",
+      "python"
+    ],
+    "tags":[ "OS.Process.ListRequest" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "Process.GetProcesses()",
+        "type": "string",
+        "scopes": [ "code" ]
+      },
+      {
+        "pattern": "ReadProcessMemory|OpenProcess|VirtualQueryEx",
+        "type": "regexword",
+        "scopes": [ "code" ]
+      },
+      {
+        "pattern": "system32\\tasklist.exe",
+        "type": "string",
+        "scopes": [ "code" ]
+      }
+    ]
+  },
+  {
+    "name": "OS: Process Access (Read)",
+    "id": "AI037300",
+    "description": "OS: Process Access (Read)",
+    "applies_to":[ "powershell" ],
+    "tags":[ "OS.Process.ListRequest" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "Get-Process ",
+        "type": "substring",
+        "scopes": [ "code" ]
+      }
+    ]
+  },
+  {
+    "name": "OS: Process Access (Read)",
+    "id": "AI037400",
+    "description": "OS: Process Access (Read)",
+    "applies_to":[ "java" ],
+    "tags":[ "OS.Process.ListRequest" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "exec.*['\\\"]ps ",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ]
+      }
+    ]
+  }
+]