@dxworks/insider 2.9.1

package/insider/config/rules/os/setenv.json

@@ -0,0 +1,270 @@
+[
+  {
+    "name": "OS: Environment Variable (Write)",
+    "id": "AI037500",
+    "description": "OS: Environment Variable (Write)",
+    "applies_to": [
+    ],
+    "tags":[ "OS.Environment.Write" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "setenv|putenv",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "_comment": "linux cmd from lang x"
+      }
+    ]
+  },
+  {
+    "name": "OS: Environment Variable (Write)",
+    "id": "AI037600",
+    "description": "OS: Environment Variable (Write)",
+    "applies_to":[ "python" ],
+    "tags":[ "OS.Environment.Write" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "\\bos\\.environ.+=",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "medium"
+      }
+    ]
+  },
+  {
+    "name": "OS: Environment Variable (Write)",
+    "id": "AI037700",
+    "description": "OS: Environment Variable (Write)",
+    "applies_to":[ "rust" ],
+    "tags":[ "OS.Environment.Write" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "env::set_var",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "OS: Environment Variable (Write)",
+    "id": "AI037800",
+    "description": "OS: Environment Variable (Write)",
+    "applies_to":[ "csharp" ],
+    "tags":[ "OS.Environment.Write" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "SetEnvironmentVariable",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "OS: Environment Variable (Write)",
+    "id": "AI037900",
+    "description": "OS: Environment Variable (Write)",
+    "applies_to":[ "powershell" ],
+    "tags":[ "OS.Environment.Write" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "SetEnvironmentVariable|\\$env:.+=",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "OS: Environment Variable (Write)",
+    "id": "AI037910",
+    "description": "OS: Environment Variable (Write)",
+    "applies_to":[ "javascript" ],
+    "tags":[ "OS.Environment.Write" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "process\\.env\\[\\\".*\\\"\\] *= *",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "app\\.set\\('environment'",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "OS: Environment Variable (Write)",
+    "id": "AI037920",
+    "description": "OS: Environment Variable (Write)",
+    "applies_to": [
+    ],
+    "tags":[ "OS.Environment.Write" ],
+    "severity": "moderate",
+    "_comment": "Windows Registry location for environment variables",
+    "patterns": [
+      {
+        "pattern": "System\\CurrentControlSet\\Control\\Session Manager\\Environment",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "medium"
+      }
+    ],
+    "conditions": [
+      {
+        "pattern": {
+          "pattern": "SetValue",
+          "type": "regex",
+          "scopes": [ "code" ],
+          "modifiers": [ "i" ]
+        },
+        "search_in": "finding-region(-10,10)",
+        "negate_finding": false
+      }
+    ]
+  },
+  {
+    "name": "OS: Environment Variable (Read)",
+    "id": "AI037930",
+    "description": "OS: Environment Variable (Read)",
+    "applies_to":[ "python" ],
+    "tags":[ "OS.Environment.Read" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "os\\.environ\\.items|os\\.environ\\[\\\".*\\\"\\]|os\\.environ\\.get",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "medium"
+      }
+    ]
+  },
+  {
+    "name": "OS: Environment Variable (Read)",
+    "id": "AI037940",
+    "description": "OS: Environment Variable (Read)",
+    "applies_to":[ "rust" ],
+    "tags":[ "OS.Environment.Read" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "env::get_var",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "OS: Environment Variable (Read)",
+    "id": "AI037950",
+    "description": "OS: Environment Variable (Read)",
+    "applies_to":[ "csharp" ],
+    "tags":[ "OS.Environment.Read" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "GetEnvironmentVariable",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "OS: Environment Variable (Read)",
+    "id": "AI037960",
+    "description": "OS: Environment Variable (Read)",
+    "applies_to":[ "powershell" ],
+    "tags":[ "OS.Environment.Read" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "GetEnvironmentVariable|\\$env:|Env:\\\\",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "OS: Environment Variable (Read)",
+    "id": "AI037970",
+    "description": "OS: Environment Variable (Read)",
+    "applies_to":[ "javascript" ],
+    "tags":[ "OS.Environment.Read" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "= *process\\.env\\[\\\".*\\\"\\]",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "app\\.get\\('environment'",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "OS: Environment Variable (Read)",
+    "id": "AI037980",
+    "description": "OS: Environment Variable (Read)",
+    "applies_to": [
+    ],
+    "tags":[ "OS.Environment.Read" ],
+    "severity": "moderate",
+    "_comment": "Windows Registry location for environment variables",
+    "patterns": [
+      {
+        "pattern": "System\\CurrentControlSet\\Control\\Session Manager\\Environment",
+        "type": "substring",
+        "scopes": [ "code" ],
+        "confidence": "medium"
+      }
+    ],
+    "conditions": [
+      {
+        "pattern": {
+          "pattern": "GetValue",
+          "type": "substring",
+          "scopes": [ "code" ],
+          "modifiers": [ "i" ]
+        },
+        "search_in": "finding-region(-10,10)",
+        "negate_finding": false
+      }
+    ]
+  },
+  {
+    "name": "OS: Environment Variable (Read)",
+    "id": "AI037990",
+    "description": "OS: Environment Variable (Read)",
+    "applies_to": [
+    ],
+    "tags":[ "OS.Environment.Read" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "getenv",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "_comment": "linux for lang x"
+      }
+    ]
+  }
+]

package/insider/config/rules/os/system_registry.json

@@ -0,0 +1,237 @@
+[
+  {
+    "name": "OS Operation: Windows Registry (Write)",
+    "id": "AI038000",
+    "description": "OS Operation: Windows Registry (Write)",
+    "tags":[ "OS.SystemRegistry.Write" ],
+    "applies_to": [
+      "c",
+      "cpp"
+    ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "RegSetValueEx|RegOpenKeyEx|RegCreateKeyEx",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "OS Operation: Windows Registry (Write)",
+    "id": "AI038100",
+    "description": "OS Operation: Windows Registry (Write)",
+    "tags":[ "OS.SystemRegistry.Write" ],
+    "applies_to":[ "csharp" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "Registry(Key)?(.*)?.(SetValue|CreateSubKey|Delete)",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "OS Operation: Windows Registry (Write)",
+    "id": "AI038110",
+    "description": "OS Operation: Windows Registry (Write)",
+    "tags":[ "OS.SystemRegistry.Write" ],
+    "applies_to":[ "csharp" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "CreateSubKey|SetValue",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ],
+    "conditions": [
+      {
+        "pattern": {
+          "pattern": "HKEY_|Registry",
+          "type": "regexword",
+          "scopes": [ "code" ]
+        },
+        "search_in": "finding-region(-40,40)",
+        "negate_finding": false
+      }
+    ]
+  },
+  {
+    "name": "OS Operation: Windows Registry (Write)",
+    "id": "AI038200",
+    "description": "OS Operation: Windows Registry (Write)",
+    "tags":[ "OS.SystemRegistry.Write" ],
+    "applies_to":[ "python" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "_?winreg\\.(Set|Delete|Create)(Key|Value)(Ex)?",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "_comment": "_winreg and winreg built-in modules"
+      }
+    ]
+  },
+  {
+    "name": "OS Operation: Windows Registry (Write)",
+    "id": "AI038210",
+    "description": "OS Operation: Windows Registry (Write)",
+    "tags":[ "OS.SystemRegistry.Write" ],
+    "applies_to":[ "powershell" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "Registry",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "(HKLM|HKCU):",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ],
+    "conditions": [
+      {
+        "pattern": {
+          "pattern": "Set-ItemProperty",
+          "type": "string",
+          "scopes": [ "code" ]
+        },
+        "search_in": "finding-region(-5,5)",
+        "negate_finding": false
+      }
+    ]
+  },
+  {
+    "name": "OS Operation: Windows Registry (ACL)",
+    "id": "AI038300",
+    "description": "OS Operation: Windows Registry (ACL)",
+    "tags":[ "OS.SystemRegistry.ACL" ],
+    "applies_to": [ "csharp" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "RegistryAccessRule|RegistrySecurity",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "OS Operation: Windows Registry (Read)",
+    "id": "AI038400",
+    "description": "OS Operation: Windows Registry (Read)",
+    "tags":[ "OS.SystemRegistry.Read" ],
+    "applies_to": [
+      "c",
+      "cpp"
+    ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "RegGetValue|RegGetDWord|RegGetString|CRegKey|RegOpenKey|RegQueryKeyEx",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "OS Operation: Windows Registry (Read)",
+    "id": "AI038500",
+    "description": "OS Operation: Windows Registry (Read)",
+    "tags":[ "OS.SystemRegistry.Read" ],
+    "applies_to":[ "powershell" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "Registry",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "(HKLM|HKCU):",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ],
+    "conditions": [
+      {
+        "pattern": {
+          "pattern": "Get-ItemProperty",
+          "type": "string",
+          "scopes": [ "code" ]
+        },
+        "search_in": "finding-region(-5,5)",
+        "negate_finding": false
+      }
+    ]
+  },
+  {
+    "name": "OS Operation: Windows Registry (Read)",
+    "id": "AI038600",
+    "description": "OS Operation: Windows Registry (Read)",
+    "tags":[ "OS.SystemRegistry.Read" ],
+    "applies_to":[ "csharp" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "Registry(Key)?(.*)?.GetValue",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ],
+    "conditions": [
+      {
+        "pattern": {
+          "pattern": "HKEY_",
+          "type": "string",
+          "scopes": [ "code" ]
+        },
+        "search_in": "finding-region(-40,40)",
+        "negate_finding": false
+      }
+    ]
+  },
+  {
+    "name": "OS Operation: Windows Registry (Read)",
+    "id": "AI038601",
+    "description": "OS Operation: Windows Registry (Read)",
+    "tags":[ "OS.SystemRegistry.Read" ],
+    "applies_to":[ "rust" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": ".open_subkey(",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ],
+    "conditions": [
+      {
+        "pattern": {
+          "pattern": "HKEY_",
+          "type": "string",
+          "scopes": [ "code" ]
+        },
+        "search_in": "finding-region(-40,40)",
+        "negate_finding": false
+      }
+    ]
+  }
+]

package/insider/config/rules/os/user_accts.json

@@ -0,0 +1,34 @@
+[
+  {
+    "name": "OS: User Account Write (Add)",
+    "id": "AI038700",
+    "description": "OS: User Account Write (Add)",
+    "applies_to":[ "csharp" ],
+    "tags":[ "OS.UserAccount.Write" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "NetUserAdd|NetGroupAddUser|NetLocalGroupAdd",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "OS: User Account Write (Modify)",
+    "id": "AI038800",
+    "description": "OS: User Account Write (Modify)",
+    "applies_to":[ "csharp" ],
+    "tags":[ "OS.UserAccount.Write" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "NetGroupSetInfo|NetGroupSetUsers|NetLocalGroupDel|NetUserChangePassword",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  }
+]