matrix-yararules

commit c6d357a717d58a02f736437fab58df8e1adbb4e7
parent 2f921809cc7ce118d5e4570cd545b05eb61e91f9
Author: MTRNord <mtrnord1@gmail.com>
Date:   Thu, 28 Sep 2023 09:22:24 +0200

Try reducing the false positives

Diffstat:
M
rules/detect_tokens.yara
 | 
18
+++++++++---------
M
rules/test.yara
 | 
2
+-

2 files changed, 10 insertions(+), 10 deletions(-)
diff --git a/rules/detect_tokens.yara b/rules/detect_tokens.yara
@@ -6,9 +6,9 @@ rule detect_synapse_token : tokens
         reference = "https://github.com/matrix-org/synapse/blob/11c6cc1115f43bf7bf1f8b99163ec3cdfa5003d9/synapse/handlers/auth.py#L1446-L1447"
         description = "This detects synapse access tokens. The synapse tokens all start with 'syt_'"
         Action = "RedactAndNotify"
-        NotifcationText = "Matrix access token detected. Please remove it before sending your message again."
+        NotifcationText = "Matrix access token detected. Please remove and revoke(!) it before sending your message again."
     strings:
-        $synapse_pattern = /syt_.{1,340}_.{20}_.{6}/
+        $synapse_pattern = /syt_.{1,340}_.{20}_.{6}/ ascii
 
     condition:
         $synapse_pattern
@@ -22,14 +22,14 @@ rule detect_github_token : tokens
         reference = "https://github.blog/2021-04-05-behind-githubs-new-authentication-token-formats/"
         description = "This detects github access tokens. See https://github.blog/2021-04-05-behind-githubs-new-authentication-token-formats/"
         Action = "RedactAndNotify"
-        NotifcationText = "Github access token detected. Please remove it before sending your message again. If this is a falsepositive make sure to include `tokenbypass1CwRlV5VtQdDPh`"
+        NotifcationText = "Github access token detected. Please remove and revoke(!) it before sending your message again. If this is a falsepositive make sure to include `tokenbypass1CwRlV5VtQdDPh`"
     strings:
-        $personal_access_token = "ghp_"
-        $oauth_access_token = "gho_"
-        $user_to_server_token = "ghu_"
-        $server_to_server_token = "ghs_"
-        $refresh_token = "ghr_"
-        $bypass = "tokenbypass1CwRlV5VtQdDPh"
+        $personal_access_token = "ghp_" ascii fullword
+        $oauth_access_token = "gho_" ascii fullword
+        $user_to_server_token = "ghu_" ascii fullword
+        $server_to_server_token = "ghs_" ascii fullword
+        $refresh_token = "ghr_" ascii fullword
+        $bypass = "tokenbypass1CwRlV5VtQdDPh" ascii fullword
 
     condition:
         ($personal_access_token or $oauth_access_token or $user_to_server_token or $server_to_server_token or $refresh_token) and not $bypass
diff --git a/rules/test.yara b/rules/test.yara
@@ -5,7 +5,7 @@ rule TestRule : test_rule
         Description = "Test Rule"
         Action = "Notify"
     strings:
-        $test_string = "Test"
+        $test_string = "Test"  ascii nocase
 
     condition:
         $test_string