Address false positives with knative and new x86 third-party rule (#1008)

* Address false positives with knative and new x86 third-party rule

Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>

* Remove strings in favor of specific file hash

Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>

---------

Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>

Author: egibs

pkg/compile/compile.go

@@ -37,6 +37,7 @@ var badRules = map[string]bool{
 	"SIGNATURE_BASE_SUSP_ELF_LNX_UPX_Compressed_File":     true,
 	"DELIVRTO_SUSP_SVG_Foreignobject_Nov24":               true,
 	"CAPE_Eternalromance":                                 true,
+	"CAPE_Formhookb":                                      true,
 	// ThreatHunting Keywords (some duplicates)
 	"Adobe_XMP_Identifier":                       true,
 	"Antivirus_Signature_signature_keyword":      true,

rules/false_positives/knative.yara

@@ -0,0 +1,11 @@
+import "hash"
+
+rule kobalos_override: override {
+  meta:
+    description                        = "webhook"
+    ESET_Kobalos                       = "harmless"
+    SIGNATURE_BASE_APT_MAL_LNX_Kobalos = "harmless"
+
+  condition:
+    (hash.sha256(0, filesize) == "572235f7943a8bab5377ed94c9dbdd8c2471e08e19ff6bc1edd0f1f3680ab25d")
+}