matrix-yararules

commit 490c6d66a09d74e968c1a62f0e61cd6ba3e4c8e2
parent 735e2834a99db5d6da5d9c147767b03542f0f65c
Author: Marcel <MTRNord@users.noreply.github.com>
Date:   Wed, 11 Oct 2023 21:37:24 +0200

Add refresh tokens to synapse rule
Diffstat:
M
rules/detect_tokens.yara
 | 
6
+++---

1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/rules/detect_tokens.yara b/rules/detect_tokens.yara
@@ -10,9 +10,10 @@ rule detect_synapse_token : tokens
         NotifcationText = "Matrix access token detected. Please remove and revoke(!) it before sending your message again."
     strings:
         $synapse_pattern = /syt_.{1,340}_.{20}_.{6}/ ascii
+        $synapse_refrech_token = /syr_.{1,340}_.{20}_.{6}/ ascii
 
     condition:
-        $synapse_pattern
+        $synapse_pattern or $synapse_refrech_token
 }
 
 rule detect_github_token : tokens
@@ -51,4 +52,4 @@ rule detect_npm_token : tokens
 
     condition:
         $access_token and not $bypass
-}
-\ No newline at end of file
+}