@dxworks/insider 2.9.1

package/insider/config/rules/infrastructure/microsoft_arm_tmpl.json

@@ -0,0 +1,198 @@
+[
+  {
+    "name": "Infrastructure As Code: Deployment (Microsoft ARM)",
+    "id": "AI031567",
+    "description": "Infrastructure As Code: Deployment (Microsoft ARM)",
+    "applies_to":[ "csharp" ],
+    "tags":[ "Infrastructure.ARM.Deployment" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "DeploymentOperationsExtensions|DeploymentScriptsClient|IDeploymentOperations|IDeploymentScriptsClient",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "https://schema\\.management\\.azure\\.com/schemas/.*deploymentTemplate\\.json",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "az deployment create",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Infrastructure As Code: Tag AddUpdate (Microsoft ARM)",
+    "id": "AI031568",
+    "description": "Infrastructure As Code: Tag AddUpdate (Microsoft ARM)",
+    "applies_to":[ "powershell" ],
+    "tags":[ "Infrastructure.ARM.TagAddUpdate" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "(New|Update|Remove)-AzTag",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "az tag create",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Infrastructure As Code: ResourceGroupAddUpdate (Microsoft ARM)",
+    "id": "AI031569",
+    "description": "Infrastructure As Code: ResourceGroupAddUpdate (Microsoft ARM)",
+    "applies_to":[ "powershell" ],
+    "tags":[ "Infrastructure.ARM.ResourceGroupAddUpdate" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "(New|Update|Remove)-AzResourceGroupDeployment",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "az group create",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Infrastructure As Code: SubscriptionAddUpdate (Microsoft ARM)",
+    "id": "AI031570",
+    "description": "Infrastructure As Code: SubscriptionAddUpdate (Microsoft ARM)",
+    "applies_to":[ "powershell" ],
+    "tags":[ "Infrastructure.ARM.SubscriptionAddUpdate" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "(New|Update|Remove)-AzSubscriptionDeployment",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "az subscription create",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Infrastructure As Code: TemplateSpecUpdate (Microsoft ARM)",
+    "id": "AI031571",
+    "description": "Infrastructure As Code: TemplateSpecUpdate (Microsoft ARM)",
+    "applies_to":[ "powershell" ],
+    "tags":[ "Infrastructure.ARM.TemplateSpecAddUpdate" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "(New|Update|Remove)-AzTemplateSpec",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "az ts create",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Infrastructure As Code: API Based (Microsoft ARM)",
+    "id": "AI031572",
+    "description": "Infrastructure As Code: API Based (Microsoft ARM)",
+    "applies_to": [
+    ],
+    "tags":[ "Infrastructure.ARM.API.General" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "https:\/\/management\\.azure\\.com\/subscriptions\/.*\/resourcegroups\/.*\/providers\/Microsoft\\.Resources\/deployments",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "https:\/\/management\\.azure\\.com\/subscriptions/.*\/providers\/Microsoft\\.Resources\/deployments",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "https:\/\/management\\.azure\\.com\/providers\/Microsoft\\.Management\/managementGroups\/providers\/Microsoft\\.Resources\/deployments",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Infrastructure As Code: Deployment (Microsoft ARM)",
+    "id": "AI031573",
+    "description": "Infrastructure As Code: Deployment (Microsoft ARM)",
+    "applies_to":[ "java" ],
+    "tags":[ "Infrastructure.ARM.Deployment" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "Deployment\\.Execution",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "medium",
+        "_comment": "add conditions to raise confidence level"
+      }
+    ]
+  },
+  {
+    "name": "Infrastructure As Code: General (Microsoft ARM)",
+    "id": "AI031574",
+    "description": "Infrastructure As Code: General (Microsoft ARM)",
+    "applies_to":[ "java" ],
+    "tags":[ "Infrastructure.ARM.General" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "com\\.microsoft\\.azure\\.management\\.resources",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "medium",
+        "_comment": "add conditions to raise confidence level"
+      }
+    ]
+  },
+  {
+    "name": "Infrastructure As Code: Deployment General (Microsoft ARM)",
+    "id": "AI031575",
+    "description": "Infrastructure As Code: (Microsoft ARM)",
+    "applies_to":[ "python" ],
+    "tags":[ "Infrastructure.ARM.General" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "from azure\\.mgmt\\.resource import ResourceManagementClient",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "medium",
+        "_comment": "add conditions to raise confidence level"
+      }
+    ]
+  }
+]

package/insider/config/rules/networkcomms/outbound_network.json

@@ -0,0 +1,429 @@
+[
+  {
+    "name": "Network Connection: FTP, Telnet or Similar",
+    "description": "Network Connection",
+    "id": "AI031600",
+    "applies_to": [
+    ],
+    "tags":[ "OS.Network.Connection.Miscellaneous" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "tftp|ntp\\.org|ntpupdate|imap|snmp|ftps|sftp|ftp|nntp|smtp|telnet|ssh|pop3|gopher",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high",
+        "_comment": "don't include auth api's patterns to avoid duplicate reporting"
+      }
+    ]
+  },
+  {
+    "name": "Network Connection: TCP",
+    "description": "Network Connection TCP",
+    "id": "AI031700",
+    "applies_to":[ "csharp" ],
+    "tags":[ "OS.Network.Connection.Tcp" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": ".Listen(",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "TcpConnection",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "(Anonymous|Named)Pipe(Client|Server)Stream",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Network Connection: TCP",
+    "description": "Network Connection",
+    "id": "AI031800",
+    "applies_to": [
+      "c",
+      "cpp"
+    ],
+    "tags":[ "OS.Network.Connection.Tcp" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "QTcpServer",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "_comment": "Qt TCP Server"
+      }
+    ]
+  },
+  {
+    "name": "Network Connection: TCP",
+    "description": "Network Connection TCP",
+    "id": "AI031900",
+    "applies_to": [
+      "c",
+      "cpp"
+    ],
+    "tags":[ "OS.Network.Connection.Tcp" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "QTcpServer",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "_comment": "Qt TCP Server"
+      },
+      {
+        "pattern": "tcp::acceptor",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "_comment": "Boost::AsynchIO"
+      },
+      {
+        "pattern": "listen(",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "_comment": "Standard C Library"
+      }
+    ]
+  },
+  {
+    "name": "Network Connection: TCP",
+    "description": "Network Connection",
+    "id": "AI031910",
+    "applies_to":[ "rust" ],
+    "tags":[ "OS.Network.Connection.Http" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "TcpStream::connect|HttpConnection",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+
+  {
+    "name": "Network Connection: Socket",
+    "description": "Network Connection Socket",
+    "id": "AI032000",
+    "applies_to":[ "python" ],
+    "tags":[ "OS.Network.Connection.Socket" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": ".bind(",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "_comment": "Python socket"
+      }
+    ]
+  },
+  {
+    "name": "Network Connection: Socket",
+    "description": "Network Socket",
+    "id": "AI032100",
+    "tags":[ "OS.Network.Connection.Socket" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "socket",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high",
+        "_comment": "general"
+      }
+    ]
+  },
+  {
+    "name": "Network Connection: Socket",
+    "description": "Network Socket",
+    "id": "AI032110",
+    "tags":[ "OS.Network.Connection.Socket" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "connect|port",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "medium",
+        "_comment": "general"
+      }
+    ]
+  },
+  {
+    "name": "Network Connection: HTTP",
+    "description": "Network Connection",
+    "id": "AI032200",
+    "applies_to":[ "csharp" ],
+    "tags":[ "OS.Network.Connection.Http" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "WebClient|HttpClient|HttpRequest|HttpWebRequest|HttpWebResponse|System\\.Net\\.Http|Microsoft\\.AspNetCore\\.Http",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Network Connection: HTTP Content (Ajax)",
+    "description": "Network Connection: HTTP Content (Ajax)",
+    "id": "AI032300",
+    "applies_to": [
+      "javascript",
+      "html"
+    ],
+    "tags":[ "OS.Network.Connection.Http.Ajax" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "(\\$|jQuery)\\.(post|get|getJSON|getScript)\\(",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "_comment": "jQuery AJAX"
+      },
+      {
+        "pattern": "fetch(",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "_comment": "Fetch API"
+      },
+      {
+        "pattern": "XMLHttpRequest",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Network Connection: HTTP",
+    "description": "Network Connection: HTTP",
+    "id": "AI032400",
+    "applies_to":[ "javascript" ],
+    "tags":[ "OS.Network.Connection.Http" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "require\\(['\\\"](http|https|request|axios|superagent|got)",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "_comment": "Common Node.js HTTP libraries"
+      }
+    ]
+  },
+  {
+    "name": "Network Connection: HTTP",
+    "description": "Network Connection: HTTP",
+    "id": "AI032500",
+    "applies_to":[ "python" ],
+    "tags":[ "OS.Network.Connection.Http" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "import .*(http|requests)",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "_comment": "Common Python HTTP libraries"
+      }
+    ]
+  },
+  {
+    "name": "Network Connection: HTTP",
+    "description": "Network Connection: HTTP",
+    "id": "AI032600",
+    "applies_to": [
+    ],
+    "tags":[ "OS.Network.Connection.Http" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "https?:\/",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "low",
+        "_comment": "HTTP URL with or without TLS"
+      },
+      {
+        "pattern": "curl|wpget",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "medium"
+      }
+    ]
+  },
+  {
+    "name": "Network Connection: HTTP",
+    "description": "Network Connection: HTTP",
+    "id": "AI032700",
+    "applies_to": [ "ruby" ],
+    "tags":[ "OS.Network.Connection.Http" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "Net::HTTP",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Network Connection: RPC",
+    "description": "Network Connection: RPC",
+    "id": "AI032800",
+    "applies_to": [ "csharp" ],
+    "tags":[ "OS.Network.Connection.RPC" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "RPC|RemotableTypeclass|System\\.Runtime\\.Remoting|RemotingConfiguration|TcpClient|TcpChannel",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Network Connection: RPC",
+    "description": "Network Connection: RPC",
+    "id": "AI032900",
+    "applies_to": [ "python" ],
+    "tags":[ "OS.Network.Connection.RPC" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "fastrpc|xmlrpc|SimpleXMLRPCServer|jsonrpc|rpc\\.server|client\\.rpc",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Network Connection: RPC",
+    "description": "Network Connection: RPC",
+    "id": "AI033000",
+    "applies_to": [ "c" ],
+    "tags":[ "OS.Network.Connection.RPC" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "capnp/ez-rpc\\.h|rpc/server\\.h",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Network Connection: RPC",
+    "description": "Network Connection: RPC",
+    "id": "AI033100",
+    "applies_to": [ "java" ],
+    "tags":[ "OS.Network.Connection.RPC" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "RmiServiceExporter|RmiProxyFactoryBean|remoting|jaxrpc|RemoteAccountService|io\\.grpc|RPCClient",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Network Connection: RPC",
+    "description": "Network Connection: RPC",
+    "id": "AI033200",
+    "applies_to": [ "javascript", "typescript" ],
+    "tags":[ "OS.Network.Connection.RPC" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "RpcProvider|jayson|json-rpc",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Network Connection: Cellular",
+    "description": "Network Connection: Cellular",
+    "id": "AI033300",
+    "applies_to": [ "c", "cpp", "csharp" ],
+    "tags":[ "OS.Network.Connection.Cellular" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "NetworkInterfaceType\\.(Wman|Wwanpp|Wwanpp2)",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "_comment": "https://docs.microsoft.com/en-us/dotnet/api/system.net.networkinformation.networkinterfacetype?view=net-5.0"
+      }
+    ]
+  },
+  {
+    "name": "Network Connection: Modem",
+    "description": "Network Connection: Modem",
+    "id": "AI033400",
+    "applies_to": [ "c", "cpp", "csharp", "java" ],
+    "tags":[ "OS.Network.Connection.Modem" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "modem",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Network Connection: General",
+    "description": "Network Connection: General",
+    "id": "AI033410",
+    "tags":[ "OS.Network.Connection.General" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "send.*message",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "low"
+      },
+      {
+        "pattern": "send\\(",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "medium"
+      }
+    ]
+  }
+]