Skip to content

typo & fp by rule name: HKTL_ladpdomaindump_bloodhound  #21

@ruppde

Description

@ruppde
  1. rule name should be HKTL_ldapdomaindump_bloodhound as per the description "Detects hack tools related to ldapdomaindump"

  2. this rule produces FP because ldapdomaindump is an official debian package and therefor appears in e.g. ~/..cache/mintinstall/pkginfo.json

        "apt:python3-ldapdomaindump": {
            "pkg_hash": "apt:python3-ldapdomaindump",
            "name": "python3-ldapdomaindump"
        },

... MATCHED_1: Str1: "ldapdomaindump" in ": "python3-ldap3"\x0a },\x0a "apt:python3-ldapdomaindump": {\x0a "pkg_hash": "apt:python3-ldapdoma" at 0x4af536 RULEDATE_1: 2019-02-04 TAGS_1: FILE, HKTL RULENAME_1: HKTL_ladpdomaindump_bloodhound

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions