New rule for "silent execution" of popen based on Pytorch attack. Some cleanup of processing whl files

[zmallen]

On Dec 31 2022, pytorch maintainers published this post detailing a supply chain attack.

It primarily focused on using dependency confusion on how pip installs packages in a particular order. An internal package was used (triton), but someone registered triton on pypi.

It was a copypasta of triton with one additional __init__.py that dropped a binary and executed it.

Triage analysis here

This P/R adds a rule that "alerts" on this attack by looking for subprocess.FUNC(...,) with arguments that make it a "silent execution" to reduce false positives. I successfully tested this on the malicious package in the post and it found the malicious code!

I thought our code execution code would catch this, but we scoped it to setup.py to reduce false positives. I think /dev/nulling std* is a very specific pattern for malware, so I added it here.

[christophetd]

Thanks for the PR, will

• Slightly reword the description
• Rebase the PR against the v1.0-rc branch

[christophetd]

Closing in favor of #119 that will be merged in v1.0-rc