From 3444dd52db3abdfca31b1588584bf6962372b0be Mon Sep 17 00:00:00 2001 From: elliottwaves-20 Date: Mon, 5 Oct 2026 23:23:46 +0200 Subject: [PATCH 1/3] fix(yara): require a browser cookie-store path in info_stealer $browser_cookies matched /Cookies.*(chrome|firefox|edge|opera)/ across a whole line, so documentation naming cookies and, later on the line, a browser or Edge Functions raised a HIGH info_stealer finding. Require a browser profile path that ends in the cookie store instead, and add the Opera and Firefox store forms. Every other string of the rule is unchanged. Fixes #751 Co-Authored-By: Claude Opus 5.5 Signed-off-by: elliottwaves-20 --- src/skillspector/yara_rules/malware.yar.b64 | 18 ++++---- tests/nodes/analyzers/test_static_yara.py | 46 +++++++++++++++++++++ 2 files changed, 57 insertions(+), 7 deletions(-) diff --git a/src/skillspector/yara_rules/malware.yar.b64 b/src/skillspector/yara_rules/malware.yar.b64 index 2763fda3e..7f4e5bb88 100644 --- a/src/skillspector/yara_rules/malware.yar.b64 +++ b/src/skillspector/yara_rules/malware.yar.b64 @@ -134,10 +134,14 @@ ICBjb25maWRlbmNlID0gIjAuNzUiDQogICAgICAgIHJlZmVyZW5jZSA9ICJodHRwczovL2dpdGh1 Yi5jb20vTmVvMjN4MC9zaWduYXR1cmUtYmFzZSINCiAgICBzdHJpbmdzOg0KICAgICAgICAkY2hy b21lX2xvZ2luICAgICA9IC9DaHJvbWUuKkxvZ2luXHMqRGF0YS8gbm9jYXNlDQogICAgICAgICRm aXJlZm94X2xvZ2lucyAgID0gL2xvZ2luc1wuanNvbi4qZmlyZWZveC8gbm9jYXNlDQogICAgICAg -ICRicm93c2VyX2Nvb2tpZXMgID0gL0Nvb2tpZXMuKihjaHJvbWV8ZmlyZWZveHxlZGdlfG9wZXJh -KS8gbm9jYXNlDQogICAgICAgICR3YWxsZXRfc3RlYWwgICAgID0gL3dhbGxldFwuZGF0LyBub2Nh -c2UNCiAgICAgICAgJG1pbWlrYXR6ICAgICAgICAgPSAibWltaWthdHoiIG5vY2FzZQ0KICAgICAg -ICAkbGF6YWduZSAgICAgICAgICA9ICJsYXphZ25lIiBub2Nhc2UNCiAgICAgICAgJGNyZWRfZHVt -cF9zYW0gICAgPSAvcmVnXHMrc2F2ZVxzKy4qXFxzYW0vIG5vY2FzZQ0KICAgICAgICAkbnRkc19k -dW1wICAgICAgICA9IC9udGRzXC5kaXQvIG5vY2FzZQ0KICAgIGNvbmRpdGlvbjoNCiAgICAgICAg -YW55IG9mIHRoZW0NCn0NCg== +ICRicm93c2VyX2Nvb2tpZXMgID0gLyhDaHJvbWV8Q2hyb21pdW18RWRnZXxCcmF2ZS1Ccm93c2Vy +KVtcXFwvJ1x4MjIsIF17MSw0fShVc2VyIERhdGFbXlxuXXswLDgwfXwoRGVmYXVsdHxQcm9maWxl +IFxkKylbXFxcLydceDIyLCBdezEsNH0oTmV0d29ya1tcXFwvJ1x4MjIsIF17MSw0fSk/KUNvb2tp +ZXMvIG5vY2FzZQ0KICAgICAgICAkb3BlcmFfY29va2llcyAgICA9IC9PcGVyYSAoU3RhYmxlfEdY +IFN0YWJsZSlbXlxuXXswLDgwfUNvb2tpZXMvIG5vY2FzZQ0KICAgICAgICAkZmlyZWZveF9jb29r +aWVzICA9IC9jb29raWVzXC5zcWxpdGUvIG5vY2FzZQ0KICAgICAgICAkd2FsbGV0X3N0ZWFsICAg +ICA9IC93YWxsZXRcLmRhdC8gbm9jYXNlDQogICAgICAgICRtaW1pa2F0eiAgICAgICAgID0gIm1p +bWlrYXR6IiBub2Nhc2UNCiAgICAgICAgJGxhemFnbmUgICAgICAgICAgPSAibGF6YWduZSIgbm9j +YXNlDQogICAgICAgICRjcmVkX2R1bXBfc2FtICAgID0gL3JlZ1xzK3NhdmVccysuKlxcc2FtLyBu +b2Nhc2UNCiAgICAgICAgJG50ZHNfZHVtcCAgICAgICAgPSAvbnRkc1wuZGl0LyBub2Nhc2UNCiAg +ICBjb25kaXRpb246DQogICAgICAgIGFueSBvZiB0aGVtDQp9DQo= diff --git a/tests/nodes/analyzers/test_static_yara.py b/tests/nodes/analyzers/test_static_yara.py index 8038f8e74..ecd9e6b5c 100644 --- a/tests/nodes/analyzers/test_static_yara.py +++ b/tests/nodes/analyzers/test_static_yara.py @@ -613,6 +613,33 @@ def _single_line_perl_socket_shell() -> str: ).decode() +# Browser cookie-store paths an information stealer reads (base64 so the test +# source itself carries no stealer indicator). +_STEALER_COOKIE_PATHS = { + "chrome_windows": "b3MucGF0aC5qb2luKG9zLmVudmlyb25bJ0xPQ0FMQVBQREFUQSddLCAnR29vZ2xlJywgJ0Nocm9tZScsICdVc2VyIERhdGEnLCAnRGVmYXVsdCcsICdOZXR3b3JrJywgJ0Nvb2tpZXMnKQ==", + "edge_windows": "Y29weSAlTE9DQUxBUFBEQVRBJVxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGFcRGVmYXVsdFxOZXR3b3JrXENvb2tpZXMgb3V0LmRi", + "brave_linux": "fi8uY29uZmlnL0JyYXZlU29mdHdhcmUvQnJhdmUtQnJvd3Nlci9Vc2VyIERhdGEvRGVmYXVsdC9Db29raWVz", + "chrome_macos": "cGF0aCA9IGhvbWUgKyAiL0xpYnJhcnkvQXBwbGljYXRpb24gU3VwcG9ydC9Hb29nbGUvQ2hyb21lL0RlZmF1bHQvQ29va2llcyI=", + "opera_windows": "JHAgPSAiJGVudjpBUFBEQVRBXE9wZXJhIFNvZnR3YXJlXE9wZXJhIFN0YWJsZVxOZXR3b3JrXENvb2tpZXMi", + "firefox_profile": "c3JjID0gcHJvZmlsZV9kaXIgLyAnY29va2llcy5zcWxpdGUn", +} + + +def _stealer_cookie_path(name: str) -> str: + return base64.b64decode(_STEALER_COOKIE_PATHS[name]).decode() + + +# Documentation that names the browser store and, later on the same line, a +# browser or product name (issue #751: a Supabase skill description). +_COOKIE_PROSE = [ + "description: Auth issues (login, logout, sessions, JWT, cookies, getSession, getUser, " + "getClaims, RLS); Supabase CLI or MCP server; debugging timeouts, Edge Function crashes\n", + "Set cookies for Edge Functions with the SSR helper.\n", + "Cookies set by the Edge middleware are httpOnly.\n", + "Forward cookies to Chrome headless through the Playwright context.\n", +] + + def _has_rule(findings: list, rule_name: str) -> bool: """Return True when a finding message references a specific YARA rule. @@ -2234,6 +2261,25 @@ def test_known_webshell_rule_matches_family_markers(self, fixture, filename): findings = _run_builtin(_webshell_fixture(fixture), filename) assert _has_rule(findings, "php_webshell_known") + @pytest.mark.parametrize( + "content", + _COOKIE_PROSE, + ids=["supabase_description", "edge_functions", "edge_middleware", "chrome_headless"], + ) + def test_info_stealer_ignores_cookie_prose(self, content): + findings = _run_builtin(content, "SKILL.md") + assert not _has_rule(findings, "info_stealer") + + @pytest.mark.parametrize("name", sorted(_STEALER_COOKIE_PATHS)) + def test_info_stealer_matches_browser_cookie_store_paths(self, name): + findings = _run_builtin(_stealer_cookie_path(name) + "\n", "collect.py") + assert _has_rule(findings, "info_stealer") + + def test_info_stealer_matches_cookie_store_path_next_to_prose(self): + content = _COOKIE_PROSE[1] + _stealer_cookie_path("chrome_windows") + "\n" + findings = _run_builtin(content, "collect.py") + assert _has_rule(findings, "info_stealer") + # ── Rule caching ────────────────────────────────────────────────────── From 9a5125ad2ab829604b528519d688a7f56466a598 Mon Sep 17 00:00:00 2001 From: elliottwaves-20 Date: Mon, 5 Oct 2026 23:39:37 +0200 Subject: [PATCH 2/3] fix(yara): keep info_stealer matches on code that names the store first The first change only matched the browser-before-store order, so code such as sqlite3.connect(chrome_profile + "/Cookies") that the previous pattern caught no longer matched. Add $cookies_browser for the store-first order with a browser name that is part of an identifier, path or string, and let $browser_cookies accept an identifier suffix (CHROME_DIR). Regression tests cover six such code forms and two more prose sentences. Refs #751 Co-Authored-By: Claude Opus 5.5 Signed-off-by: elliottwaves-20 --- src/skillspector/yara_rules/malware.yar.b64 | 22 ++++++++-------- tests/nodes/analyzers/test_static_yara.py | 28 ++++++++++++++++++++- 2 files changed, 39 insertions(+), 11 deletions(-) diff --git a/src/skillspector/yara_rules/malware.yar.b64 b/src/skillspector/yara_rules/malware.yar.b64 index 7f4e5bb88..999d4ae4a 100644 --- a/src/skillspector/yara_rules/malware.yar.b64 +++ b/src/skillspector/yara_rules/malware.yar.b64 @@ -135,13 +135,15 @@ Yi5jb20vTmVvMjN4MC9zaWduYXR1cmUtYmFzZSINCiAgICBzdHJpbmdzOg0KICAgICAgICAkY2hy b21lX2xvZ2luICAgICA9IC9DaHJvbWUuKkxvZ2luXHMqRGF0YS8gbm9jYXNlDQogICAgICAgICRm aXJlZm94X2xvZ2lucyAgID0gL2xvZ2luc1wuanNvbi4qZmlyZWZveC8gbm9jYXNlDQogICAgICAg ICRicm93c2VyX2Nvb2tpZXMgID0gLyhDaHJvbWV8Q2hyb21pdW18RWRnZXxCcmF2ZS1Ccm93c2Vy -KVtcXFwvJ1x4MjIsIF17MSw0fShVc2VyIERhdGFbXlxuXXswLDgwfXwoRGVmYXVsdHxQcm9maWxl -IFxkKylbXFxcLydceDIyLCBdezEsNH0oTmV0d29ya1tcXFwvJ1x4MjIsIF17MSw0fSk/KUNvb2tp -ZXMvIG5vY2FzZQ0KICAgICAgICAkb3BlcmFfY29va2llcyAgICA9IC9PcGVyYSAoU3RhYmxlfEdY -IFN0YWJsZSlbXlxuXXswLDgwfUNvb2tpZXMvIG5vY2FzZQ0KICAgICAgICAkZmlyZWZveF9jb29r -aWVzICA9IC9jb29raWVzXC5zcWxpdGUvIG5vY2FzZQ0KICAgICAgICAkd2FsbGV0X3N0ZWFsICAg -ICA9IC93YWxsZXRcLmRhdC8gbm9jYXNlDQogICAgICAgICRtaW1pa2F0eiAgICAgICAgID0gIm1p -bWlrYXR6IiBub2Nhc2UNCiAgICAgICAgJGxhemFnbmUgICAgICAgICAgPSAibGF6YWduZSIgbm9j -YXNlDQogICAgICAgICRjcmVkX2R1bXBfc2FtICAgID0gL3JlZ1xzK3NhdmVccysuKlxcc2FtLyBu -b2Nhc2UNCiAgICAgICAgJG50ZHNfZHVtcCAgICAgICAgPSAvbnRkc1wuZGl0LyBub2Nhc2UNCiAg -ICBjb25kaXRpb246DQogICAgICAgIGFueSBvZiB0aGVtDQp9DQo= +KVx3KltcXFwvJ1x4MjIsIF17MSw0fShVc2VyIERhdGFbXlxuXXswLDgwfXwoRGVmYXVsdHxQcm9m +aWxlIFxkKylbXFxcLydceDIyLCBdezEsNH0oTmV0d29ya1tcXFwvJ1x4MjIsIF17MSw0fSk/KUNv +b2tpZXMvIG5vY2FzZQ0KICAgICAgICAkY29va2llc19icm93c2VyICA9IC9Db29raWVzW15cbl17 +MCw4MH1bXmEtel0oY2hyb21lfGNocm9taXVtfGVkZ2V8YnJhdmV8b3BlcmF8ZmlyZWZveCkoX3xc +Llx3fFtcXFwvJ1x4MjIoXSkvIG5vY2FzZQ0KICAgICAgICAkb3BlcmFfY29va2llcyAgICA9IC9P +cGVyYSAoU3RhYmxlfEdYIFN0YWJsZSlbXlxuXXswLDgwfUNvb2tpZXMvIG5vY2FzZQ0KICAgICAg +ICAkZmlyZWZveF9jb29raWVzICA9IC9jb29raWVzXC5zcWxpdGUvIG5vY2FzZQ0KICAgICAgICAk +d2FsbGV0X3N0ZWFsICAgICA9IC93YWxsZXRcLmRhdC8gbm9jYXNlDQogICAgICAgICRtaW1pa2F0 +eiAgICAgICAgID0gIm1pbWlrYXR6IiBub2Nhc2UNCiAgICAgICAgJGxhemFnbmUgICAgICAgICAg +PSAibGF6YWduZSIgbm9jYXNlDQogICAgICAgICRjcmVkX2R1bXBfc2FtICAgID0gL3JlZ1xzK3Nh +dmVccysuKlxcc2FtLyBub2Nhc2UNCiAgICAgICAgJG50ZHNfZHVtcCAgICAgICAgPSAvbnRkc1wu +ZGl0LyBub2Nhc2UNCiAgICBjb25kaXRpb246DQogICAgICAgIGFueSBvZiB0aGVtDQp9DQo= diff --git a/tests/nodes/analyzers/test_static_yara.py b/tests/nodes/analyzers/test_static_yara.py index ecd9e6b5c..66a14a305 100644 --- a/tests/nodes/analyzers/test_static_yara.py +++ b/tests/nodes/analyzers/test_static_yara.py @@ -629,6 +629,17 @@ def _stealer_cookie_path(name: str) -> str: return base64.b64decode(_STEALER_COOKIE_PATHS[name]).decode() +# Code that names the store before the browser, as the previous pattern did. +_STEALER_COOKIE_CODE = { + "sqlite_connect": "Y29va2llc19kYiA9IHNxbGl0ZTMuY29ubmVjdChjaHJvbWVfcHJvZmlsZSArICIvQ29va2llcyIp", + "copy_to_output": "c2h1dGlsLmNvcHkocHJvZmlsZSAvICJDb29raWVzIiwgY2hyb21lX291dCk=", + "browser_constant": "ZGIgPSBvcy5wYXRoLmpvaW4oQ0hST01FX0RJUiwgIkRlZmF1bHQiLCAiQ29va2llcyIp", + "browser_argument": "c3RlYWwoIkNvb2tpZXMiLCAiZmlyZWZveCIp", + "keyword_argument": "Z3JhYl9jb29raWVzKGJyb3dzZXI9ImVkZ2UiKQ==", + "attribute_access": "Y29va2llcyA9IHJlYWQob3BlcmEucHJvZmlsZSk=", +} + + # Documentation that names the browser store and, later on the same line, a # browser or product name (issue #751: a Supabase skill description). _COOKIE_PROSE = [ @@ -637,6 +648,8 @@ def _stealer_cookie_path(name: str) -> str: "Set cookies for Edge Functions with the SSR helper.\n", "Cookies set by the Edge middleware are httpOnly.\n", "Forward cookies to Chrome headless through the Playwright context.\n", + "Clear cookies in Chrome.\n", + "Cookies are shared with Edge, Chrome and Firefox.\n", ] @@ -2264,7 +2277,14 @@ def test_known_webshell_rule_matches_family_markers(self, fixture, filename): @pytest.mark.parametrize( "content", _COOKIE_PROSE, - ids=["supabase_description", "edge_functions", "edge_middleware", "chrome_headless"], + ids=[ + "supabase_description", + "edge_functions", + "edge_middleware", + "chrome_headless", + "clear_in_chrome", + "shared_with_browsers", + ], ) def test_info_stealer_ignores_cookie_prose(self, content): findings = _run_builtin(content, "SKILL.md") @@ -2275,6 +2295,12 @@ def test_info_stealer_matches_browser_cookie_store_paths(self, name): findings = _run_builtin(_stealer_cookie_path(name) + "\n", "collect.py") assert _has_rule(findings, "info_stealer") + @pytest.mark.parametrize("name", sorted(_STEALER_COOKIE_CODE)) + def test_info_stealer_matches_code_naming_the_store_first(self, name): + code = base64.b64decode(_STEALER_COOKIE_CODE[name]).decode() + findings = _run_builtin(code + "\n", "collect.py") + assert _has_rule(findings, "info_stealer") + def test_info_stealer_matches_cookie_store_path_next_to_prose(self): content = _COOKIE_PROSE[1] + _stealer_cookie_path("chrome_windows") + "\n" findings = _run_builtin(content, "collect.py") From db2c85744fa935cdac244e48c79077970a8a2596 Mon Sep 17 00:00:00 2001 From: elliottwaves-20 Date: Tue, 13 Oct 2026 11:51:16 +0200 Subject: [PATCH 3/3] fix(yara): count a quote in info_stealer only around the browser name $cookies_browser accepted an apostrophe after the browser name, so English possessives such as "blocked by Chrome's tracking protection" still gave HIGH YR1. A quote now counts only when it encloses the browser name ("edge", 'chrome'). A slash or backslash after the browser name counts only when a path character or quote precedes it (/chromium/, google-chrome/, "chromium/), so a browser list such as "Chrome/Edge" in prose no longer matches. Identifiers keep the (_|\.\w|[(]) follow set, which now also accepts a glob star (-path '*chrome*'). $browser_cookies allows up to five separator characters, so the spaced pathlib form Path.home() / "Chrome" / "User Data" / ... / "Cookies" matches. Refs #751 Co-Authored-By: Claude Opus 5.5 Signed-off-by: elliottwaves-20 --- src/skillspector/yara_rules/malware.yar.b64 | 10 ++++++---- tests/nodes/analyzers/test_static_yara.py | 10 ++++++++++ 2 files changed, 16 insertions(+), 4 deletions(-) diff --git a/src/skillspector/yara_rules/malware.yar.b64 b/src/skillspector/yara_rules/malware.yar.b64 index 999d4ae4a..9370ef658 100644 --- a/src/skillspector/yara_rules/malware.yar.b64 +++ b/src/skillspector/yara_rules/malware.yar.b64 @@ -135,11 +135,13 @@ Yi5jb20vTmVvMjN4MC9zaWduYXR1cmUtYmFzZSINCiAgICBzdHJpbmdzOg0KICAgICAgICAkY2hy b21lX2xvZ2luICAgICA9IC9DaHJvbWUuKkxvZ2luXHMqRGF0YS8gbm9jYXNlDQogICAgICAgICRm aXJlZm94X2xvZ2lucyAgID0gL2xvZ2luc1wuanNvbi4qZmlyZWZveC8gbm9jYXNlDQogICAgICAg ICRicm93c2VyX2Nvb2tpZXMgID0gLyhDaHJvbWV8Q2hyb21pdW18RWRnZXxCcmF2ZS1Ccm93c2Vy -KVx3KltcXFwvJ1x4MjIsIF17MSw0fShVc2VyIERhdGFbXlxuXXswLDgwfXwoRGVmYXVsdHxQcm9m -aWxlIFxkKylbXFxcLydceDIyLCBdezEsNH0oTmV0d29ya1tcXFwvJ1x4MjIsIF17MSw0fSk/KUNv +KVx3KltcXFwvJ1x4MjIsIF17MSw1fShVc2VyIERhdGFbXlxuXXswLDgwfXwoRGVmYXVsdHxQcm9m +aWxlIFxkKylbXFxcLydceDIyLCBdezEsNX0oTmV0d29ya1tcXFwvJ1x4MjIsIF17MSw1fSk/KUNv b2tpZXMvIG5vY2FzZQ0KICAgICAgICAkY29va2llc19icm93c2VyICA9IC9Db29raWVzW15cbl17 -MCw4MH1bXmEtel0oY2hyb21lfGNocm9taXVtfGVkZ2V8YnJhdmV8b3BlcmF8ZmlyZWZveCkoX3xc -Llx3fFtcXFwvJ1x4MjIoXSkvIG5vY2FzZQ0KICAgICAgICAkb3BlcmFfY29va2llcyAgICA9IC9P +MCw4MH0oW15hLXpdKGNocm9tZXxjaHJvbWl1bXxlZGdlfGJyYXZlfG9wZXJhfGZpcmVmb3gpKF98 +XC5cd3xbKCpdKXxbXFxcL1wtLidceDIyXShjaHJvbWV8Y2hyb21pdW18ZWRnZXxicmF2ZXxvcGVy +YXxmaXJlZm94KVtcXFwvXXxbJ1x4MjJdKGNocm9tZXxjaHJvbWl1bXxlZGdlfGJyYXZlfG9wZXJh +fGZpcmVmb3gpWydceDIyXSkvIG5vY2FzZQ0KICAgICAgICAkb3BlcmFfY29va2llcyAgICA9IC9P cGVyYSAoU3RhYmxlfEdYIFN0YWJsZSlbXlxuXXswLDgwfUNvb2tpZXMvIG5vY2FzZQ0KICAgICAg ICAkZmlyZWZveF9jb29raWVzICA9IC9jb29raWVzXC5zcWxpdGUvIG5vY2FzZQ0KICAgICAgICAk d2FsbGV0X3N0ZWFsICAgICA9IC93YWxsZXRcLmRhdC8gbm9jYXNlDQogICAgICAgICRtaW1pa2F0 diff --git a/tests/nodes/analyzers/test_static_yara.py b/tests/nodes/analyzers/test_static_yara.py index 66a14a305..718544873 100644 --- a/tests/nodes/analyzers/test_static_yara.py +++ b/tests/nodes/analyzers/test_static_yara.py @@ -622,6 +622,7 @@ def _single_line_perl_socket_shell() -> str: "chrome_macos": "cGF0aCA9IGhvbWUgKyAiL0xpYnJhcnkvQXBwbGljYXRpb24gU3VwcG9ydC9Hb29nbGUvQ2hyb21lL0RlZmF1bHQvQ29va2llcyI=", "opera_windows": "JHAgPSAiJGVudjpBUFBEQVRBXE9wZXJhIFNvZnR3YXJlXE9wZXJhIFN0YWJsZVxOZXR3b3JrXENvb2tpZXMi", "firefox_profile": "c3JjID0gcHJvZmlsZV9kaXIgLyAnY29va2llcy5zcWxpdGUn", + "chrome_pathlib_spaced": "UGF0aC5ob21lKCkgLyAiQXBwRGF0YSIgLyAiTG9jYWwiIC8gIkdvb2dsZSIgLyAiQ2hyb21lIiAvICJVc2VyIERhdGEiIC8gIkRlZmF1bHQiIC8gIk5ldHdvcmsiIC8gIkNvb2tpZXMi", } @@ -637,6 +638,9 @@ def _stealer_cookie_path(name: str) -> str: "browser_argument": "c3RlYWwoIkNvb2tpZXMiLCAiZmlyZWZveCIp", "keyword_argument": "Z3JhYl9jb29raWVzKGJyb3dzZXI9ImVkZ2UiKQ==", "attribute_access": "Y29va2llcyA9IHJlYWQob3BlcmEucHJvZmlsZSk=", + "find_glob": "ZmluZCB+IC1uYW1lIENvb2tpZXMgLXBhdGggJypjaHJvbWUqJw==", + "quoted_path_segment": "c2h1dGlsLmNvcHkoaG9tZSArICIvQ29va2llcyIsICIvdG1wLyIgKyAiY2hyb21pdW0vIiArIG5hbWUp", + "dashed_path_segment": "c3JjID0gIkNvb2tpZXMiOyBkc3QgPSBwcm9maWxlX3Jvb3QgKyAiLy5jb25maWcvZ29vZ2xlLWNocm9tZS9vdXQi", } @@ -650,6 +654,9 @@ def _stealer_cookie_path(name: str) -> str: "Forward cookies to Chrome headless through the Playwright context.\n", "Clear cookies in Chrome.\n", "Cookies are shared with Edge, Chrome and Firefox.\n", + "Third-party cookies are blocked by Chrome's tracking protection.\n", + "Session cookies are dropped by Firefox's Enhanced Tracking Protection.\n", + "Cookies: Chrome/Edge supported, Safari planned.\n", ] @@ -2284,6 +2291,9 @@ def test_known_webshell_rule_matches_family_markers(self, fixture, filename): "chrome_headless", "clear_in_chrome", "shared_with_browsers", + "chrome_possessive", + "firefox_possessive", + "browser_list_with_slash", ], ) def test_info_stealer_ignores_cookie_prose(self, content):