matrix-yararules

commit af54a51a8e866c4f1fd5e09b945602b65ca695b3
Author: MTRNord <mtrnord1@gmail.com>
Date:   Thu, 28 Sep 2023 01:26:10 +0200

Initial commit

Diffstat:
A
.gitignore
 | 
3
+++
A
README.md
 | 
13
+++++++++++++
A
detect_tokens.yara
 | 
33
+++++++++++++++++++++++++++++++++
A
test.yara
 | 
12
++++++++++++

4 files changed, 61 insertions(+), 0 deletions(-)
diff --git a/.gitignore b/.gitignore
@@ -0,0 +1,2 @@
+test
+CCCS-Yara
+\ No newline at end of file
diff --git a/README.md b/README.md
@@ -0,0 +1,13 @@
+# Public Base Rules for YARA in Matrix
+
+These are rules that are considered to be safe to publish to the public. They are not considered to be sensitive in nature and are not considered to be a risk to the organization if they are published.
+
+These rules are made to be used for [Matrix](https://matrix.org) messages in conjunction with the Draupnir Bot and the yara protection.
+
+This repository is following the <https://github.com/CybercentreCanada/CCCS-Yara.git> spec as best as possible.
+
+Additionally there is the `Action` metadata which is used to determine what action to take when a rule matches. The following actions are supported:
+
+- `Notify` - Notify the admins in the admin room about a match
+- `RedactAndNotify` - Redact the message and notify the admins in the admin room about a match. In combination with the `NotifcationText` metadata
+this also notifies a user in the room about the match with the defined message.
diff --git a/detect_tokens.yara b/detect_tokens.yara
@@ -0,0 +1,32 @@
+rule detect_synapse_token : tokens
+{
+    meta:
+        Author = "MTRNord"
+        Description = "This detects synapse access tokens. The synapse tokens all start with 'syt_'"
+        Action = "RedactAndNotify"
+        NotifcationText = "Matrix access token detected. Please remove it before sending your message again."
+    strings:
+        $synapse_pattern = /syt_.{1,340}_.{20}_.{6}/
+
+    condition:
+        $synapse_pattern
+}
+
+rule detect_github_token : tokens
+{
+    meta:
+        Author = "MTRNord"
+        Description = "This detects github access tokens. See https://github.blog/2021-04-05-behind-githubs-new-authentication-token-formats/"
+        Action = "RedactAndNotify"
+        NotifcationText = "Github access token detected. Please remove it before sending your message again. If this is a falsepositive make sure to include `tokenbypass1CwRlV5VtQdDPh`"
+    strings:
+        $personal_access_token = "ghp_"
+        $oauth_access_token = "gho_"
+        $user_to_server_token = "ghu_"
+        $server_to_server_token = "ghs_"
+        $refresh_token = "ghr_"
+        $bypass = "tokenbypass1CwRlV5VtQdDPh"
+
+    condition:
+        ($personal_access_token or $oauth_access_token or $user_to_server_token or $server_to_server_token or $refresh_token) and not $bypass
+}
+\ No newline at end of file
diff --git a/test.yara b/test.yara
@@ -0,0 +1,12 @@
+rule TestRule : test_rule
+{
+    meta:
+        Author = "MTRNord"
+        Description = "Test Rule"
+        Action = "Notify"
+    strings:
+        $test_string = "Test"
+
+    condition:
+        $test_string
+}