@dxworks/insider 2.9.1

package/config/rules/cloud_services/data_storage.json

@@ -0,0 +1,291 @@
+[
+  {
+    "name": "CloudServices: DataStorage (Azure)",
+    "id": "AI002500",
+    "description": "CloudServices: DataStorage (Azure Table,File,Blob)",
+    "applies_to":[ "csharp" ],
+    "tags": [
+      "CloudServices.DataStorage.Microsoft.Azure",
+      "CloudServices.Hosting.Microsoft.Azure"
+    ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "CloudStorageAccount|Microsoft\\.Azure\\.Storage|Microsoft\\.Azure\\.Cosmos\\.Table|Microsoft\\.Azure\\.Documents|Microsoft\\.WindowsAzure\\.Storage",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "cosmosdb",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "modifiers": [ "i" ]
+      }
+    ]
+  },
+  {
+    "name": "CloudServices: DataStorage (Azure)",
+    "id": "AI002600",
+    "description": "CloudServices: DataStorage (Azure Table,File,Blob)",
+    "applies_to": [
+      "python",
+      "java",
+      "yaml",
+      "pom.xml"
+    ],
+    "tags":[ "CloudServices.DataStorage.Microsoft.Azure" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "(BlockBlobService|azure)\\.storage|cosmosdb\\.azure\\.com|BlobStorageAccount",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "cosmosdb",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "modifiers": [ "i" ]
+      }
+    ]
+  },
+  {
+    "name": "CloudServices: DataStorage (Azure)",
+    "id": "AI002700",
+    "description": "CloudServices: DataStorage (Azure Table,File,Blob)",
+    "applies_to":[ "javascript" ],
+    "tags":[ "CloudServices.DataStorage.Microsoft.Azure" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "\\.createBlobService",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "medium"
+      },
+      {
+        "pattern": "azure/storage-blob",
+        "type": "substring",
+        "scopes": [ "code" ],
+        "confidence": "medium"
+      }
+    ]
+  },
+  {
+    "name": "CloudServices: DataStorage (AzureKeyVault)",
+    "id": "AI002710",
+    "description": "CloudServices: DataStorage (AzureKeyVault)",
+    "applies_to":[ "csharp" ],
+    "tags": [
+      "CloudServices.DataStorage.Microsoft.AzureKeyVault",
+      "Data.Sensitive.Secret"
+    ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "new ClientSecret|KeyVaultClient|Microsoft\\.Azure\\.KeyVault|Microsoft\\.Azure\\.Management\\.KeyVault",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "keyvault",
+        "type": "regexword",
+        "scopes": [ "code", "comment" ],
+        "modifiers": ["i"],
+        "confidence": "medium"
+      },
+      {
+        "pattern": "azure\\.keyvault|azure\\.mgmt\\.keyvault",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "modifiers": ["i"]
+      }
+    ]
+  },
+  {
+    "name": "CloudServices: DataStorage (HashiCorp Vault)",
+    "id": "AI002730",
+    "description": "CloudServices: DataStorage (HashiCorp Vault)",
+    "applies_to":[ "csharp" ],
+    "tags": [
+      "CloudServices.DataStorage.HashiCorp.Vault",
+      "Data.Sensitive.Secret"
+    ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "VaultClientSettings|IVaultClient",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "hashicorp|VaultSharp",
+        "type": "regex",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "CloudServices: DataStorage (HashiCorp Vault)",
+    "id": "AI002740",
+    "description": "CloudServices: DataStorage (HashiCorp Vault)",
+    "tags": [
+      "CloudServices.DataStorage.HashiCorp.Vault",
+      "Data.Sensitive.Secret"
+    ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "vaultSharp|hashicorp|spring vault|import org.springframework.vault",
+        "type": "regex",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ],
+        "confidence": "high",
+        "_comment": "includes vaultsharp here for possible use in PS"
+      }
+    ]
+  },
+  {
+    "name": "CloudServices: DataStorage (Azure)",
+    "id": "AI002800",
+    "description": "CloudServices: DataStorage (Azure) Table,File,Blob",
+    "applies_to": [
+      "c",
+      "cpp"
+    ],
+    "tags":[ "CloudServices.DataStorage.Microsoft.Azure" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "azure::storage|#include <was\/storage_account\\.h>",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "CloudServices: DataStorage (Microsoft OneDrive)",
+    "id": "AI002900",
+    "description": "CloudServices: DataStorage (Microsoft OneDrive)",
+    "tags":[ "CloudServices.DataStorage.Microsoft.OneDrive" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "OneDrive",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "modifiers": [ "i" ]
+      }
+    ]
+  },
+  {
+    "name": "CloudServices: DataStorage (Amazon S3)",
+    "id": "AI003000",
+    "description": "CloudServices: DataStorage (Amazon S3)",
+    "applies_to": [
+      "c",
+      "cpp"
+    ],
+    "tags":[ "CloudServices.DataStorage.Amazon.S3" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "aws/s3/|Aws::S3",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "CloudServices: DataStorage (Amazon S3)",
+    "id": "AI003100",
+    "description": "CloudServices: DataStorage (Amazon S3)",
+    "applies_to":[ "csharp" ],
+    "tags":[ "CloudServices.DataStorage.Amazon.S3" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "Amazon.S3",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "CloudServices: DataStorage (Amazon S3)",
+    "id": "AI003200",
+    "description": "CloudServices: DataStorage (Amazon S3)",
+    "applies_to":[ "python" ],
+    "tags":[ "CloudServices.DataStorage.Amazon.S3" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "boto3",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "CloudServices: DataStorage (Google Drive)",
+    "id": "AI003300",
+    "description": "CloudServices: DataStorage (Google Drive)",
+    "tags":[ "CloudServices.DataStorage.Google.Drive" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "googleapis.com/upload/drive",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "modifiers": ["i"]
+      }
+    ]
+  },
+  {
+    "name": "CloudServices: DataStorage (DropBox)",
+    "id": "AI003400",
+    "description": "CloudServices: DataStorage (DropBox)",
+    "tags":[ "CloudServices.DataStorage.DropBox" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "api.dropboxapi.com",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "modifiers": ["i"]
+      }
+    ]
+  },
+  {
+    "name": "CloudServices: DataStorage (MediaFire)",
+    "id": "AI003500",
+    "description": "CloudServices: DataStorage (MediaFire)",
+    "tags":[ "CloudServices.DataStorage.MediaFire" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "MediaFire",
+        "type": "substring",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "modifiers": ["i"]
+      }
+    ]
+  }
+]

package/config/rules/cloud_services/ecommerce.json

@@ -0,0 +1,45 @@
+[
+  {
+    "name": "CloudServices: Financial (eCommerce)",
+    "id": "AI003600",
+    "description": "Data: Financial (eCommerce)",
+    "tags":[ "CloudServices.Finance.eCommerce" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "wallet|fips-140",
+        "type": "regexword",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ],
+        "confidence": "medium"
+      },
+      {
+        "pattern": "paypal|google pay|ebay|google\\.com/pay/api",
+        "type": "regex",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "price|shopping chart|payment",
+        "type": "regexword",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ]
+      },
+      {
+        "pattern": "bigcommerce|shopify|bigcartel|woocommerce|wc_api_client|weebly|3dcart|squarespace|connect\\.squareup\\.com",
+        "type": "regex",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "demandware|yocart|opencart|magento|magentohost\/api|volusion|x-vtex-api-appkey|alibaba|apple.*pay",
+        "type": "regexword",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  }
+]

package/config/rules/cloud_services/socialmedia.json

@@ -0,0 +1,82 @@
+[
+  {
+    "name": "Social Media: Facebook",
+    "id": "AI003700",
+    "description": "Social Media Facebook",
+    "tags":[ "CloudServices.SocialMedia.Facebook" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "facebook",
+        "type": "string",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Social Media: Twitter",
+    "id": "AI003800",
+    "description": "Social Media (Twitter)",
+    "tags":[ "CloudServices.SocialMedia.Twitter" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "twitter",
+        "type": "string",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Social Media: YouTube",
+    "id": "AI003900",
+    "description": "Social Media (YouTube)",
+    "tags":[ "CloudServices.SocialMedia.YouTube" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "youtube",
+        "type": "string",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Social Media: Instagram",
+    "id": "AI004000",
+    "description": "Social Media: Instagram",
+    "tags":[ "CloudServices.SocialMedia.Instagram" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "instagram",
+        "type": "string",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Social Media: Misc",
+    "id": "AI004100",
+    "description": "Social Media: Misc",
+    "tags":[ "CloudServices.SocialMedia.Misc" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "reddit|snapchat|whatsapp|tumblr|qzone|weibo|pinterest|ask\\.fm|flickr|linkedin|odnoklassniki|meetup|discord|diaspora|sociall\\.io|mastodon",
+        "type": "regexword",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  }
+]

package/config/rules/cloud_services/web_analytics.json

@@ -0,0 +1,108 @@
+[
+  {
+    "name": "Miscellaneous: Analytics Service",
+    "id": "AI004200",
+    "description": "Miscellaneous: Analytics Service",
+    "tags":[ "CloudServices.Web.Analytics" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "analytics|tracker|tracking|tracking cookie|pixel url|tracking script",
+        "type": "regexword",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ],
+        "confidence": "low"
+      }
+    ]
+  },
+  {
+    "name": "Miscellaneous: Analytics Service (Facebook)",
+    "id": "AI004300",
+    "description": "Miscellaneous: Analytics Service (Facebook)",
+    "tags":[ "CloudServices.Web.Analytics.Facebook" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "connect.facebook.net",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ]
+      }
+    ]
+  },
+  {
+    "name": "Miscellaneous: Analytics Service (Google GTag)",
+    "id": "AI004400",
+    "description": "Miscellaneous: Analytics Service (Google GTag)",
+    "tags":[ "CloudServices.Web.Analytics.Google.GTag" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "googletagmanager.com",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ]
+      }
+    ]
+  },
+  {
+    "name": "Miscellaneous: Analytics Service (Bing)",
+    "id": "AI004500",
+    "description": "Miscellaneous: Analytics Service (Bing)",
+    "tags":[ "CloudServices.Web.Analytics.Microsoft.Bing" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "bat.bing.com",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ]
+      }
+    ]
+  },
+  {
+    "name": "Miscellaneous: Analytics Service (Twitter)",
+    "id": "AI004600",
+    "description": "Miscellaneous: Analytics Service (Twitter)",
+    "tags":[ "CloudServices.Web.Analytics.Twitter" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "static.ads-twitter.com",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ]
+      }
+    ]
+  },
+  {
+    "name": "Miscellaneous: Analytics Service (Outbrain)",
+    "id": "AI004700",
+    "description": "Miscellaneous: Analytics Service (Outbrain)",
+    "tags":[ "CloudServices.Web.Analytics.Outbrain" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "amplify.outbrain.com",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ]
+      }
+    ]
+  },
+  {
+    "name": "Miscellaneous: Analytics Service (Pinterest)",
+    "id": "AI004800",
+    "description": "Miscellaneous: Analytics Service (Pinterest)",
+    "tags":[ "CloudServices.Web.Analytics.Pinterest" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "s.pinimg.com",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ]
+      }
+    ]
+  }
+]

package/config/rules/components/active_content.json

@@ -0,0 +1,157 @@
+[
+  {
+    "name": "Component: Adobe Flash",
+    "id": "AI004900",
+    "description": "Component: Adobe Flash",
+    "applies_to": [
+    ],
+    "tags":[ "Component.Executable.Adobe.Flash" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "\\.(swf|flv)",
+        "type": "regex",
+        "scopes": [ "code", "comment" ],
+        "confidence": "high",
+        "modifiers": [ "i" ]
+      },
+      {
+        "pattern": "adobe flash",
+        "type": "string",
+        "scopes": [ "code", "comment" ],
+        "confidence": "medium",
+        "modifiers": [ "i" ]
+      },
+      {
+        "pattern": "flash",
+        "type": "regexword",
+        "scopes": [ "code", "comment" ],
+        "confidence": "low",
+        "modifiers": [ "i" ]
+      }
+    ]
+  },
+  {
+    "name": "Component: Active-X",
+    "id": "AI005000",
+    "description": "Component: Active-X",
+    "applies_to": [
+      "c",
+      "cpp",
+      "csharp",
+      "vb"
+    ],
+    "tags":[ "Component.Executable.Microsoft.ActiveX" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "CoInitialize|CoCreateInstance|comClassInterface|CLSCTX_INPROC_SERVER|ProgId|COleControlModule|ComDefaultInterface|IOleInPlaceObject|IOleControl|IOleObjective",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "Type\\.GetTypeFromProgID",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "medium"
+      },
+      {
+        "pattern": "active-?x",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "medium"
+      }
+    ]
+  },
+  {
+    "name": "Component: Active-X",
+    "id": "AI005001",
+    "description": "Component: Active-X",
+    "applies_to":[ "vb" ],
+    "tags":[ "Component.Executable.Microsoft.ActiveX" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "= CreateObject(",
+        "type": "substring",
+        "scopes": [ "code" ],
+        "confidence": "low"
+      }
+    ]
+  },
+  {
+    "name": "Component: Active-X",
+    "id": "AI005010",
+    "description": "Component: Active-X",
+    "applies_to":[ "javascript", "typescript" ],
+    "tags":[ "Component.Executable.Microsoft.ActiveX" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "new ActiveXObject",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Component: COM",
+    "id": "AI005100",
+    "description": "Component: COM",
+    "applies_to": [
+      "c",
+      "cpp",
+      "csharp"
+    ],
+    "tags":[ "Component.Executable.Microsoft.COM" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CoCreateInstance",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Component: PDF",
+    "id": "AI005200",
+    "description": "Component: PDF",
+    "applies_to": [
+      "c",
+      "cpp",
+      "csharp"
+    ],
+    "tags":[ "Component.Executable.Adobe.PDF" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": ".pdf",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "modifiers": [ "i" ]
+      }
+    ]
+  },
+  {
+    "name": "Component: Microsoft Silverlight",
+    "id": "AI005300",
+    "description": "Component: Microsoft Silverlight",
+    "tags":[ "Component.Executable.Microsoft.Silverlight" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "silverlight|\\.xap",
+        "type": "regex",
+        "modifiers": [ "i" ],
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  }
+]