mirror of
https://github.com/github/codeql.git
synced 2026-08-03 17:03:02 +02:00
39 lines
1.4 KiB
Plaintext
39 lines
1.4 KiB
Plaintext
/**
|
|
* @name Number of Solorigate-related command names in enum is above the threshold
|
|
* @description The enum contains several values that look similar to command and control command names, which may indicate that the code may have been tampered with by an external agent.
|
|
* It is recommended to review the code and verify that there is no unexpected code in this project.
|
|
* @kind problem
|
|
* @tags security
|
|
* solorigate
|
|
* @problem.severity warning
|
|
* @precision medium
|
|
* @id cs/solorigate/number-of-known-commands-in-enum-above-threshold
|
|
*/
|
|
|
|
import csharp
|
|
import Solorigate
|
|
|
|
/*
|
|
* Returns the total number of Solorigate-related commands in the given enum
|
|
*
|
|
* This command list is described at https://www.fireeye.com/blog/products-and-services/2020/12/global-intrusion-campaign-leverages-software-supply-chain-compromise.html
|
|
* and the enum names are based from https://github.com/ITAYC0HEN/SUNBURST-Cracked/tree/a01f358965525bee34ad026acd9dfda3d488fdd8
|
|
*/
|
|
|
|
int countSolorigateCommandInEnum(Enum e) {
|
|
result =
|
|
count(string s, EnumConstant ec |
|
|
e.getAnEnumConstant() = ec and
|
|
s = ec.getName() and
|
|
s = solorigateSuspiciousCommandsInEnum()
|
|
)
|
|
}
|
|
|
|
from Enum e, int total
|
|
where
|
|
total = countSolorigateCommandInEnum(e) and
|
|
total > 10
|
|
select e,
|
|
"This enum may be related to Solorigate. It matches " + total +
|
|
" of the values used for commands in the enum."
|