Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit d775528

Browse files
raulgarciamsftraulgarciamsft
committed
Fixes on multiple files.
1 parent d48a713 commit d775528

13 files changed

Lines changed: 24 additions & 26 deletions

‎csharp/ql/src/experimental/Security Features/backdoor/DangerousNativeFunctionCall.qhelp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,11 @@
33
"qhelp.dtd">
44
<qhelp>
55
<overview>
6-
<p>This query finds native calls to external functions that are often used in creating backdoors or are generally attributed to unsafe code practices.</p>
6+
<p>This query finds native calls to external functions that are often used in creating backdoors or are generally attributed to unsafe code practices. This is an example of a query that may be useful for detecting potential backdoors. Solorigate is one example that uses this mechanism.</p>
77
</overview>
88

99
<recommendation>
10-
<p>Any findings from this rules is only intended to indicate suspicious code that shares similarities with known portions of code used for the Solorigate attack, but no certainty that the code is related or part of any attack.</p>
10+
<p>Any findings from this rule are only intended to indicate suspicious code that shares similarities with known portions of code used for the Solorigate attack. There is no certainty that the code is related or that the code is part of any attack.</p>
1111
<p>For more information about Solorigate, please visit https://aka.ms/solorigate. </p>
1212
</recommendation>
1313

‎csharp/ql/src/experimental/Security Features/backdoor/DangerousNativeFunctionCall.ql‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
/**
22
* @name Potential dangerous use of native functions
3-
* @description Please review code for possible malicious intent or unsafe handling.
4-
* NOTE: This query is an example of a query that may be useful for detecting potential backdoors, and Solorigate is just one such example that uses this mechanism.
3+
* @description Detects the use of native functions that can be used for malicious intent or unsafe handling.
54
* @kind problem
65
* @problem.severity warning
76
* @precision low

‎csharp/ql/src/experimental/Security Features/backdoor/PotentialTimeBomb.qhelp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,11 @@
33
"qhelp.dtd">
44
<qhelp>
55
<overview>
6-
<p>This query finds if there exists a DataFlow from a file last modification date (very likely implant installation time) and an offset to a condition statement (the trigger) that controls code execution.</p>
6+
<p>This query checks for data flow from a file's last modification date and a condition statement that controls code execution. A malicious actor could have implanted code that triggers after a certain time, leading to a "time bomb".</p>
77
</overview>
88

99
<recommendation>
10-
<p>Any findings from this rules is only intended to indicate suspicious code that shares similarities with known portions of code used for the Solorigate attack, but no certainty that the code is related or part of any attack.</p>
10+
<p>Any findings from this rule are only intended to indicate suspicious code that shares similarities with known portions of code used for the Solorigate attack. There is no certainty that the code is related or that the code is part of any attack.</p>
1111
<p>For more information about Solorigate, please visit https://aka.ms/solorigate. </p>
1212
</recommendation>
1313

‎csharp/ql/src/experimental/Security Features/backdoor/PotentialTimeBomb.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/**
22
* @name Potential Timebomb
3-
* @description Flow from a file last modification date (very likely implant installation time) and an offset to condition statement (the trigger)
3+
* @description If there is data flow from a file's last modification date and an offset to a condition statement, this could trigger a "time bomb".
44
* @kind path-problem
55
* @precision Low
66
* @problem.severity warning

‎csharp/ql/src/experimental/Security Features/backdoor/ProcessNameToHashTaintFlow.qhelp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,11 @@
44
<qhelp>
55
<overview>
66
<p>This query detects code flow from ProcessName property on the Process class into a hash function.</p>
7-
<p>Such flow is often used in code backdoors to detect runnig processes and compare them to an obfuscated list of antivirus processes to aviod detection.</p>
7+
<p>Such flow is often used in code backdoors to detect running processes and compare them to an obfuscated list of antivirus processes to avoid detection. Solorigate is one example that uses this mechanism.</p>
88
</overview>
99

1010
<recommendation>
11-
<p>Any findings from this rules is only intended to indicate suspicious code that shares similarities with known portions of code used for the Solorigate attack, but no certainty that the code is related or part of any attack.</p>
11+
<p>Any findings from this rule are only intended to indicate suspicious code that shares similarities with known portions of code used for the Solorigate attack. There is no certainty that the code is related or that the code is part of any attack.</p>
1212
<p>For more information about Solorigate, please visit https://aka.ms/solorigate. </p>
1313
</recommendation>
1414

‎csharp/ql/src/experimental/Security Features/backdoor/ProcessNameToHashTaintFlow.ql‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
/**
22
* @name ProcessName to hash function flow
3-
* @description Flow from a function retrieving process name to a hash function
4-
* NOTE: This query is an example of a query that may be useful for detecting potential backdoors, and Solorigate is just one such example that uses this mechanism.
3+
* @description Flow from a function retrieving process name to a hash function.
54
* @kind path-problem
65
* @tags security
76
* solorigate
@@ -20,12 +19,12 @@ class DataFlowFromMethodToHash extends TaintTracking::Configuration {
2019
/**
2120
* Holds if `source` is a relevant data flow source.
2221
*/
23-
override predicate isSource(Node source) { isSuspiciousPropertyName(source.asExpr()) }
22+
override predicate isSource(DataFlow::Node source) { isSuspiciousPropertyName(source.asExpr()) }
2423

2524
/**
2625
* Holds if `sink` is a relevant data flow sink.
2726
*/
28-
override predicate isSink(Node sink) { isGetHash(sink.asExpr()) }
27+
override predicate isSink(DataFlow::Node sink) { isGetHash(sink.asExpr()) }
2928
}
3029

3130
predicate isGetHash(Expr arg) {

‎csharp/ql/src/experimental/Security Features/campaign/Solorigate/ModifiedFnvFunctionDetection.qhelp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@
33
"qhelp.dtd">
44
<qhelp>
55
<overview>
6-
<p>The malicious code included hash values calculated using a standard FNV-1A 64-bit hash with an additional XOR by a literal after computing the FNV-1A.</p>
7-
<p>This query detects FNV-like hash calculations where there is an additional xor (with any static value) after the hash calculation loop.</p>
6+
<p>In Solorigate, the malicious code tried to evade various security detection software by comparing hashes of the process names against an embedded list of values. The malicious code included hash values calculated using a standard FNV-1A 64-bit hash with an additional XOR by a literal after computing the FNV-1A.</p>
7+
<p>This query detects FNV-like hash calculations where there is an additional XOR (with any static value) after the hash calculation loop.</p>
88
</overview>
99

1010
<include src="Solorigate.qhelp" />

‎csharp/ql/src/experimental/Security Features/campaign/Solorigate/NumberOfKnownCommandsAboveThreshold.qhelp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@
33
"qhelp.dtd">
44
<qhelp>
55
<overview>
6-
<p>This query detects if there is an enum that includes various of the values used for the Solorigate commands.</p>
7-
<p>Please notice that by themselves the names of these enum constants are not malign.</p>
6+
<p>This query detects enumerations that include various commands that were also used in the Solorigate implant.</p>
7+
<p>By themselves, the names of these enumeration constants are not malicious, so the query only detects enumerations that includes at least 10 of the 18 Solorigate commands.</p>
88
</overview>
99

1010
<include src="Solorigate.qhelp" />

‎csharp/ql/src/experimental/Security Features/campaign/Solorigate/NumberOfKnownHashesAboveThreshold.ql‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
/**
2-
* @name Number of Solorigate-related Hashes as literals is above the threshold
3-
* @description The total number of Solorigate-related hash literals found in the code is above a threshold, which may indicate that the code may have been tampered by an external agent.
4-
* It is recommended to review the code and verify that there is no unexpected code in this project, however it is highly unlikely the hash values would be present coincideentally
2+
* @name Number of Solorigate-related hashes as literals is above the threshold
3+
* @description The total number of Solorigate-related hash literals found in the code is above a threshold, which may indicate that an external agent has tampered with the code.
4+
* It is recommended to review the code and verify that there is no unexpected code in this project, however it is highly unlikely the hash values would be present coincidentally.
55
* @kind problem
66
* @tags security
77
* solorigate
@@ -14,7 +14,7 @@ import csharp
1414
import Solorigate
1515

1616
/*
17-
* Returns the total number of Solorigate-related literales found in the project
17+
* Returns the total number of Solorigate-related hashes found in the project
1818
*/
1919

2020
int countSolorigateSuspiciousHash() {

‎csharp/ql/src/experimental/Security Features/campaign/Solorigate/NumberOfKnownLiteralsAboveThreshold.ql‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/**
22
* @name Number of Solorigate-related literals is above the threshold
3-
* @description The total number of Solorigate-related literals found in the code is above a threshold, which may indicate that the code may have been tampered by an external agent.
3+
* @description The total number of Solorigate-related literals found in the code is above a threshold, which may indicate that an external agent has tampered with the code.
44
* It is recommended to review the code and verify that there is no unexpected code in this project.
55
* @kind problem
66
* @tags security
@@ -14,7 +14,7 @@ import csharp
1414
import Solorigate
1515

1616
/*
17-
* Returns the total number of Solorigate-related literales found in the project
17+
* Returns the total number of Solorigate-related literals found in the project
1818
*/
1919

2020
int countSolorigateSuspiciousLiterals() {

0 commit comments

Comments
 (0)