False-Positive ( APT_Backdoor_Win_DShell_2.yar ) about red_team_tool_countermeasures HOT 4 CLOSED

EDIT: FYI this does not hit any of the DShell rules in
https://github.com/fireeye/red_team_tool_countermeasures/tree/master/rules/DSHELL/production/yara

only in the https://github.com/fireeye/red_team_tool_countermeasures/all-yara.yar file.

This does have a FP matching the open source project https://github.com/CyberShadow/dhcptest

APT_Backdoor_Win_DShell_2 ../c32514711f72002e9a540c2434dee7b239485d01a95a7530b939fed43f277f6d
0x8295:$dlang6: ....\src\phobos\std\utf.d
0x606d:$dlang8: ....\src\phobos\std\format.d
0x67c1:$dlang8: ....\src\phobos\std\format.d
0x10e71:$dlang10: ....\src\phobos\std\stdio.d
<snipped all the $s* matches>

https://www.virustotal.com/gui/file/c32514711f72002e9a540c2434dee7b239485d01a95a7530b939fed43f277f6d/behavior/

Confirmed hash match with compiled binary linked from the github project page: http://files.thecybershadow.net/dhcptest/old/dhcptest-0.6-win32.exe

I have not analyzed the dhcptest program to determine how the rule may be modified, but wanted to make you aware.

from red_team_tool_countermeasures.

to save people a click:

from red_team_tool_countermeasures.

Despite the Tencent detection, I don't think this rule matches the file:

The rule should not flag rdmd thanks to these ignores:

Unfortunately, I don't have any insight into why Tencent flags this file nor how they've derived detections from this repository.

I'm going to close this issue because I think that the rule works as intended. If I misunderstood something, please reopen and I'm happy to discuss further.

from red_team_tool_countermeasures.

a022820a62198fa3e3b89749b38db1cc3a09136524682fb99a3ce36652725065 is listed in https://github.com/fireeye/red_team_tool_countermeasures/blob/master/all-hashes.csv - Is that a mistake?

from red_team_tool_countermeasures.