Including "$ " prompt in IOC command can lead to false positive
jojopi opened this issue · 2 comments
jojopi commented
This work has rightly gone viral, and at least one person not understanding the "$/#" prompt convention has received a false "System infected" result: http://www.raspberrypi.org/phpBB3/viewtopic.php?p=522156#p522156
I hesitate to suggest a solution to this problem, because obviously none is perfect. But perhaps omitting the "$" on non-root commands would be safer than including it.
bvanheu commented
IOCs for Perl/Calfbot doesn't prefix the commands with "$".
Perhaps we should remove the "$" in front of all command, and making it clear that it should be run in a shell.