matrix-yararules

commit 7d6eba2a530a0ca22d959298bc993ec04956eaaa
parent 7bd1116f6bcb0fc1c6bec0b5ba2772cdc491449c
Author: MTRNord <mtrnord1@gmail.com>
Date:   Sat, 30 Sep 2023 14:43:32 +0200

Reduce false positives of github token detection

Diffstat:
M
rules/detect_tokens.yara
 | 
10
+++++-----
M
samples/tokens
 | 
5
+++--

2 files changed, 8 insertions(+), 7 deletions(-)
diff --git a/rules/detect_tokens.yara b/rules/detect_tokens.yara
@@ -26,11 +26,11 @@ rule detect_github_token : tokens
         Action = "RedactAndNotify"
         NotifcationText = "Github access token detected. Please remove and revoke(!) it before sending your message again. If this is a falsepositive make sure to include `tokenbypass1CwRlV5VtQdDPh`"
     strings:
-        $personal_access_token = /ghp_.{1,255}/ ascii fullword
-        $oauth_access_token = /gho_.{1,255}/ ascii fullword
-        $user_to_server_token = /ghu_.{1,255}/ ascii fullword
-        $server_to_server_token = /ghs_.{1,255}/ ascii fullword
-        $refresh_token = /ghr_.{1,255}/ ascii fullword
+        $personal_access_token = /ghp_[A-Za-z0-9_]{1,255}/ ascii fullword
+        $oauth_access_token = /gho_[A-Za-z0-9_]{1,255}/ ascii fullword
+        $user_to_server_token = /ghu_[A-Za-z0-9_]{1,255}/ ascii fullword
+        $server_to_server_token = /ghs_[A-Za-z0-9_]{1,255}/ ascii fullword
+        $refresh_token = /ghr_[A-Za-z0-9_]{1,255}/ ascii fullword
         $bypass = "tokenbypass1CwRlV5VtQdDPh" ascii fullword
 
     condition:
diff --git a/samples/tokens b/samples/tokens
@@ -1 +1,3 @@
-.syt_R9_52D4Wh3'*	o++wp_{Uc_3;H8Y}.���_�	r�A.ghp_.U��� ����]�.gho_.U�����\��]�.ghu_.U���d�����]�.ghs_.U����v4��]�.ghr_.U���\���]�..ڊ�;
-\ No newline at end of file
+syt_bXRybm9yZA_00000000000000000000_1VGpr3
+
+ghp_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa