matrix-yararules

commit 563fa76a8469d98be2f0ea33fbdc48d7a3f8ed94
parent cc7b06e0207656042e04f5b469836588d08c184e
Author: Marcel <MTRNord@users.noreply.github.com>
Date:   Mon, 23 Oct 2023 12:30:57 +0200

Try to fix falsely detected dependabot branches
Diffstat:
M
rules/detect_tokens.yara
 | 
4
++--

1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/rules/detect_tokens.yara b/rules/detect_tokens.yara
@@ -49,7 +49,7 @@ rule detect_npm_token : tokens
     strings:
         $access_token = /npm_[A-Za-z0-9]{1,255}/ ascii fullword
         $bypass = "tokenbypass1CwRlV5VtQdDPh" ascii fullword
-
+        $underscore = "_" ascii	       
     condition:
-        $access_token and not $bypass
+        ($access_token and #underscore == 1) and not $bypass
 }