Merge pull request #31 from CybercentreCanada/update/sig-fp

Update/sig fp [dev]
CybercentreCanada · Jul 25, 2022 · d81d21c · d81d21c
2 parents 4bf5e4b + 65eb183
commit d81d21c
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 2 deletions.
diff --git a/cape/cape_result.py b/cape/cape_result.py
@@ -23,7 +23,7 @@
 from assemblyline_v4_service.common.safelist_helper import is_tag_safelisted
 from assemblyline_v4_service.common.tag_helper import add_tag
 
-from cape.signatures import get_category_id
+from cape.signatures import get_category_id, CAPE_DROPPED_SIGNATURES
 from cape.safe_process_tree_leaf_hashes import SAFE_PROCESS_TREE_LEAF_HASHES
 from assemblyline_v4_service.common.dynamic_service_helper import (
     extract_iocs_from_text_blob,
@@ -385,6 +385,9 @@ def process_signatures(
     for sig in sigs:
         sig_name = sig["name"]
 
+        if sig_name in CAPE_DROPPED_SIGNATURES:
+            continue
+
         if not is_process_martian and sig_name == "process_martian":
             is_process_martian = True
 

diff --git a/cape/signatures.py b/cape/signatures.py
@@ -873,7 +873,7 @@
     "Virus": {"id": 54, "description": "Malicious software program."},
 }
 
-CAPE_DROPPED_SIGNATURES = []
+CAPE_DROPPED_SIGNATURES = ["powershell_scriptblock_logging"]
 
 
 def get_category_id(sig: str) -> int: