I realize the answers will be language specific, but I am curious what terms you would look for when checking something out on Github? I was looking for a remote administration tool that I could use with clients, and found some awesome ones, that happen to be "viruses"
Now I have seen enterprise high priced tools like SolarWinds MSP Connect, Dameware, and so on that do most of those same things, but QuasarRAT is listed as a virus when I try compiling it.
I was playing with the idea of taking the QuasarRAT program apart, segmenting each feature into plugins, remove any that may be malicious only, but then I am not sure it still wouldn't be listed as a virus.
In PHP I would look for obfuscated code that was using base64_decode(), exec() and so on, but I am curious what terms I should be on the lookout for with C#, C++ C, Bash - specifically those that may involve keylogging, transmitting data to a remote host, or downloading additional things to the computer?
Things I can think of are TcpListener, AcceptTcpClient, stream, bind, sockets, http, wget, curl, ftp, ssh, rsync. Since I am not fluent in C++, C, and I know I have more to learn in Bash and C#, I would love suggestions for those fun Easter eggs that people have hidden that you have found.
While I realize that just because these terms are used, it doesn't mean it IS malicious, but at least I can focus some time on that function and decide what it is doing, what else is calling it, and if it is approved.
IF we can get a good list together, I will try to come up with a script that will automatically search and bring back the matches for review.