Neo23x0/Loki

False positive yara rule

Tsirantonakis opened this issue · 0 comments

Hello, cool tool!!

I think i have found a false positive, i had the latest kibana installed in ubuntu 20 and i got this:

FILE: /usr/share/kibana/x-pack/plugins/security_solution/target/public/securitySolution.chunk.7.js SCORE: 70 TYPE: UNKNOWN SIZE: 4293720
FIRST_BYTES: 2f2a2120436f7079726967687420456c61737469 / <filter object at 0x7f5fbda12828>
MD5: 3cc57d2fc435a7751dc02fecd32e9c6b
SHA1: f1b68488bd9f8663bd0dff851da2e1058ad2ac97
SHA256: 723a18a34573a33de5b97c6b01fe2d6192ed7e440f42f896d6544e176f8a0ab5 CREATED: Mon Jun 28 14:44:00 2021 MODIFIED: Thu Jun 10 23:24:23 2021 ACCESSED: Thu Jul 29 13:10:05 2021
REASON_1: Yara Rule MATCH: Hacktool_Strings_p0wnedShell SUBSCORE: 70
DESCRIPTION: p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedShell.cs REF: https://github.com/Cn33liz/p0wnedShell
MATCHES: Str1: Invoke-ReflectivePEInjection