matrix-yararules

commit cc7b06e0207656042e04f5b469836588d08c184e
parent 490c6d66a09d74e968c1a62f0e61cd6ba3e4c8e2
Author: Marcel <MTRNord@users.noreply.github.com>
Date:   Tue, 17 Oct 2023 22:15:08 +0200

Underscores aren't actually allowed
Diffstat:
M
rules/detect_tokens.yara
 | 
12
++++++------

1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/rules/detect_tokens.yara b/rules/detect_tokens.yara
@@ -27,11 +27,11 @@ rule detect_github_token : tokens
         Action = "RedactAndNotify"
         NotifcationText = "Github access token detected. Please remove and revoke(!) it before sending your message again. If this is a falsepositive make sure to include `tokenbypass1CwRlV5VtQdDPh`"
     strings:
-        $personal_access_token = /ghp_[A-Za-z0-9_]{1,255}/ ascii fullword
-        $oauth_access_token = /gho_[A-Za-z0-9_]{1,255}/ ascii fullword
-        $user_to_server_token = /ghu_[A-Za-z0-9_]{1,255}/ ascii fullword
-        $server_to_server_token = /ghs_[A-Za-z0-9_]{1,255}/ ascii fullword
-        $refresh_token = /ghr_[A-Za-z0-9_]{1,255}/ ascii fullword
+        $personal_access_token = /ghp_[A-Za-z0-9]{1,255}/ ascii fullword
+        $oauth_access_token = /gho_[A-Za-z0-9]{1,255}/ ascii fullword
+        $user_to_server_token = /ghu_[A-Za-z0-9]{1,255}/ ascii fullword
+        $server_to_server_token = /ghs_[A-Za-z0-9]{1,255}/ ascii fullword
+        $refresh_token = /ghr_[A-Za-z0-9]{1,255}/ ascii fullword
         $bypass = "tokenbypass1CwRlV5VtQdDPh" ascii fullword
 
     condition:
@@ -47,7 +47,7 @@ rule detect_npm_token : tokens
         Action = "RedactAndNotify"
         NotifcationText = "NPM access token detected. Please remove and revoke(!) it before sending your message again. If this is a falsepositive make sure to include `tokenbypass1CwRlV5VtQdDPh`"
     strings:
-        $access_token = /npm_[A-Za-z0-9_]{1,255}/ ascii fullword
+        $access_token = /npm_[A-Za-z0-9]{1,255}/ ascii fullword
         $bypass = "tokenbypass1CwRlV5VtQdDPh" ascii fullword
 
     condition: