file/bash/bash-scanner.yaml

id: bash-scanner

info:
  name: Bash Scanner
  author: ransomsec
  severity: info
  description: Indicator for bash Dangerous Commands – You Should Never Execute on Linux
  reference:
    - https://www.tecmint.com/10-most-dangerous-commands-you-should-never-execute-on-linux/
    - https://phoenixnap.com/kb/dangerous-linux-terminal-commands
  tags: bash,file,shell,sh

file:
  - extensions:
      - sh

    extractors:
      - type: regex
        name: fork-bomb
        regex:
          - ":(){:|:&};:"

      - type: regex
        name: rm command found
        regex:
          - "rm -(f|r)"
          - "rm -(fr|rf)"

      - type: regex
        name: code injection
        regex:
          - "/bin/(sh|bash) -"
          - "eval"
          - "echo -c"
          - "/bin/(sh|bash) -c"
          - "(sh|bash) -"
          - "(sh|bash) -c"

      - type: regex
        name: file manipulation
        regex:
          - "cat /dev/null >"

      - type: regex
        name: unknown filedownload
        regex:
          - '(wget|curl) (https?|ftp|file)://[-A-Za-z0-9\+&@#/%?=~_|!:,.;]*[-A-Za-z0-9\+&@#/%=~_|]\.[-A-Za-z0-9\+&@#/%?=~_|!:,.;]*[-A-Za-z0-9\+&@#/%=~_|]$'
# digest: 4a0a004730450221009d958257bd9ea7aa63ea47fb4e99dde8f10a3c9899c1d9b1af8ae2f2d914d8290220350c7869bfb9bf6e242475bda1bd3bae8410b28d2288c03e6b139552091123f5:922c64590222798bb761d5b6d8e72950
-												Bash Scanner!

Idea behind this file, i downloaded a shell script from the internet, and i don't revive the source code of the file, and run it, but the file is contains `rm -rf .` command, after running the file, my all files are deleted in current directory. :-(
											
										
										
											2022-09-14 16:06:58 +05:30
+								id: bash-scanner
 								info:
-												Update bash.yaml
											
										
										
											2022-09-19 14:57:53 +05:30
+								  name: Bash Scanner
-												Bash Scanner!

Idea behind this file, i downloaded a shell script from the internet, and i don't revive the source code of the file, and run it, but the file is contains `rm -rf .` command, after running the file, my all files are deleted in current directory. :-(
											
										
										
											2022-09-14 16:06:58 +05:30
+								  author: ransomsec
 								  severity: info
-												Update bash.yaml
											
										
										
											2022-09-19 14:57:53 +05:30
+								  description: Indicator for bash Dangerous Commands – You Should Never Execute on Linux
-												Bash Scanner!

Idea behind this file, i downloaded a shell script from the internet, and i don't revive the source code of the file, and run it, but the file is contains `rm -rf .` command, after running the file, my all files are deleted in current directory. :-(
											
										
										
											2022-09-14 16:06:58 +05:30
+								  reference:
-												Update bash.yaml
											
										
										
											2022-09-19 14:57:53 +05:30
+								    - https://www.tecmint.com/10-most-dangerous-commands-you-should-never-execute-on-linux/
 								    - https://phoenixnap.com/kb/dangerous-linux-terminal-commands
-												Update bash-scanner.yaml
											
										
										
											2023-04-14 16:22:36 +02:00
+								  tags: bash,file,shell,sh
-												lint fix

											
										
										
											2023-12-14 10:56:01 +07:00
-												Bash Scanner!

Idea behind this file, i downloaded a shell script from the internet, and i don't revive the source code of the file, and run it, but the file is contains `rm -rf .` command, after running the file, my all files are deleted in current directory. :-(
											
										
										
											2022-09-14 16:06:58 +05:30
+								file:
 								  - extensions:
-												Update bash.yaml
											
										
										
											2022-09-19 14:57:53 +05:30
+								      - sh
-												Bash Scanner!

Idea behind this file, i downloaded a shell script from the internet, and i don't revive the source code of the file, and run it, but the file is contains `rm -rf .` command, after running the file, my all files are deleted in current directory. :-(
											
										
										
											2022-09-14 16:06:58 +05:30
 								    extractors:
 								      - type: regex
 								        name: fork-bomb
 								        regex:
 								          - ":(){:|:&};:"
 								      - type: regex
-												Dashboard Content Enhancements (#5497)

Dashboard Content Enhancements
											
										
										
											2022-09-29 09:38:41 -04:00
+								        name: rm command found
-												Bash Scanner!

Idea behind this file, i downloaded a shell script from the internet, and i don't revive the source code of the file, and run it, but the file is contains `rm -rf .` command, after running the file, my all files are deleted in current directory. :-(
											
										
										
											2022-09-14 16:06:58 +05:30
+								        regex:
 								          - "rm -(f|r)"
 								          - "rm -(fr|rf)"
 								      - type: regex
 								        name: code injection
 								        regex:
 								          - "/bin/(sh|bash) -"
 								          - "eval"
 								          - "echo -c"
 								          - "/bin/(sh|bash) -c"
 								          - "(sh|bash) -"
 								          - "(sh|bash) -c"
 								      - type: regex
 								        name: file manipulation
 								        regex:
 								          - "cat /dev/null >"
 								      - type: regex
-												Update bash.yaml
											
										
										
											2022-09-19 14:57:53 +05:30
+								        name: unknown filedownload
-												Bash Scanner!

Idea behind this file, i downloaded a shell script from the internet, and i don't revive the source code of the file, and run it, but the file is contains `rm -rf .` command, after running the file, my all files are deleted in current directory. :-(
											
										
										
											2022-09-14 16:06:58 +05:30
+								        regex:
 								          - '(wget|curl) (https?|ftp|file)://[-A-Za-z0-9\+&@#/%?=~_|!:,.;]*[-A-Za-z0-9\+&@#/%=~_|]\.[-A-Za-z0-9\+&@#/%?=~_|!:,.;]*[-A-Za-z0-9\+&@#/%=~_|]$'
-												chore: sign templates 🤖

											
										
										
											2024-12-01 13:57:55 +00:00
+								# digest: 4a0a004730450221009d958257bd9ea7aa63ea47fb4e99dde8f10a3c9899c1d9b1af8ae2f2d914d8290220350c7869bfb9bf6e242475bda1bd3bae8410b28d2288c03e6b139552091123f5:922c64590222798bb761d5b6d8e72950