matrix-yararules

commit 596c3c9c1669729efd00adb632ebbcbfdf1fd337
parent c6d357a717d58a02f736437fab58df8e1adbb4e7
Author: MTRNord <mtrnord1@gmail.com>
Date:   Thu, 28 Sep 2023 20:18:02 +0200

Add hashes

Diffstat:
M
rules/detect_tokens.yara
 | 
2
++
M
rules/test.yara
 | 
3
++-

2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/rules/detect_tokens.yara b/rules/detect_tokens.yara
@@ -4,6 +4,7 @@ rule detect_synapse_token : tokens
         sharing = "TLP:CLEAR"
         author = "MTRNord"
         reference = "https://github.com/matrix-org/synapse/blob/11c6cc1115f43bf7bf1f8b99163ec3cdfa5003d9/synapse/handlers/auth.py#L1446-L1447"
+        hash = " 825de8cbbd5cbdfd6efbff9038b3e2fbd1fc9fe6a6f73b50ee98dfead52bc3c6 "
         description = "This detects synapse access tokens. The synapse tokens all start with 'syt_'"
         Action = "RedactAndNotify"
         NotifcationText = "Matrix access token detected. Please remove and revoke(!) it before sending your message again."
@@ -21,6 +22,7 @@ rule detect_github_token : tokens
         author = "MTRNord"
         reference = "https://github.blog/2021-04-05-behind-githubs-new-authentication-token-formats/"
         description = "This detects github access tokens. See https://github.blog/2021-04-05-behind-githubs-new-authentication-token-formats/"
+        hash = " 825de8cbbd5cbdfd6efbff9038b3e2fbd1fc9fe6a6f73b50ee98dfead52bc3c6 "
         Action = "RedactAndNotify"
         NotifcationText = "Github access token detected. Please remove and revoke(!) it before sending your message again. If this is a falsepositive make sure to include `tokenbypass1CwRlV5VtQdDPh`"
     strings:
diff --git a/rules/test.yara b/rules/test.yara
@@ -3,9 +3,10 @@ rule TestRule : test_rule
     meta:
         Author = "MTRNord"
         Description = "Test Rule"
+        hash = "06fdc3d7d60da6b884fd69d7d1fd3c824ec417b2b7cdd40a7bb8c9fb72fb655b"
         Action = "Notify"
     strings:
-        $test_string = "Test"  ascii nocase
+        $test_string = "Test" ascii nocase
 
     condition:
         $test_string