commit 735e2834a99db5d6da5d9c147767b03542f0f65c parent b4dc72e78148d4c04a227cba846c67f7eca4ed28 Author: MTRNord <mtrnord1@gmail.com> Date: Sat, 30 Sep 2023 15:46:40 +0200 Add npm token detection Diffstat:
| M | rules/detect_tokens.yara | | | 16 | ++++++++++++++++ |
1 file changed, 16 insertions(+), 0 deletions(-)
diff --git a/rules/detect_tokens.yara b/rules/detect_tokens.yara @@ -35,4 +35,20 @@ rule detect_github_token : tokens condition: ($personal_access_token or $oauth_access_token or $user_to_server_token or $server_to_server_token or $refresh_token) and not $bypass +} + +rule detect_npm_token : tokens +{ + meta: + sharing = "TLP:CLEAR" + author = "MTRNord" + description = "This detects npm access tokens." + Action = "RedactAndNotify" + NotifcationText = "NPM access token detected. Please remove and revoke(!) it before sending your message again. If this is a falsepositive make sure to include `tokenbypass1CwRlV5VtQdDPh`" + strings: + $access_token = /npm_[A-Za-z0-9_]{1,255}/ ascii fullword + $bypass = "tokenbypass1CwRlV5VtQdDPh" ascii fullword + + condition: + $access_token and not $bypass } \ No newline at end of file