matrix-yararules

Some safe for public yara rules that can be used in Matrix
git clone git://archive.git.mtrnord.blog/MTRNord/matrix-yararules.git
Log | Files | Refs | README

detect_tokens.yara (2694B)

      1 rule detect_synapse_token : tokens
      2 {
      3     meta:
      4         sharing = "TLP:CLEAR"
      5         author = "MTRNord"
      6         reference = "https://github.com/matrix-org/synapse/blob/11c6cc1115f43bf7bf1f8b99163ec3cdfa5003d9/synapse/handlers/auth.py#L1446-L1447"
      7         hash = "825de8cbbd5cbdfd6efbff9038b3e2fbd1fc9fe6a6f73b50ee98dfead52bc3c6"
      8         description = "This detects synapse access tokens. The synapse tokens all start with 'syt_'"
      9         Action = "RedactAndNotify"
     10         NotifcationText = "Matrix access token detected. Please remove and revoke(!) it before sending your message again."
     11     strings:
     12         $synapse_pattern = /syt_.{1,340}_.{20}_.{6}/ ascii
     13         $synapse_refrech_token = /syr_.{1,340}_.{20}_.{6}/ ascii
     14 
     15     condition:
     16         $synapse_pattern or $synapse_refrech_token
     17 }
     18 
     19 rule detect_github_token : tokens
     20 {
     21     meta:
     22         sharing = "TLP:CLEAR"
     23         author = "MTRNord"
     24         reference = "https://github.blog/2021-04-05-behind-githubs-new-authentication-token-formats/"
     25         description = "This detects github access tokens. See https://github.blog/2021-04-05-behind-githubs-new-authentication-token-formats/"
     26         hash = "baa9e39c5ae9c01bd248d92c6e63f6299d3ca37fc9f977bf92ecd927354fe84c"
     27         Action = "RedactAndNotify"
     28         NotifcationText = "Github access token detected. Please remove and revoke(!) it before sending your message again. If this is a falsepositive make sure to include `tokenbypass1CwRlV5VtQdDPh`"
     29     strings:
     30         $personal_access_token = /ghp_[A-Za-z0-9]{1,255}/ ascii fullword
     31         $oauth_access_token = /gho_[A-Za-z0-9]{1,255}/ ascii fullword
     32         $user_to_server_token = /ghu_[A-Za-z0-9]{1,255}/ ascii fullword
     33         $server_to_server_token = /ghs_[A-Za-z0-9]{1,255}/ ascii fullword
     34         $refresh_token = /ghr_[A-Za-z0-9]{1,255}/ ascii fullword
     35         $bypass = "tokenbypass1CwRlV5VtQdDPh" ascii fullword
     36 
     37     condition:
     38         ($personal_access_token or $oauth_access_token or $user_to_server_token or $server_to_server_token or $refresh_token) and not $bypass
     39 }
     40 
     41 rule detect_npm_token : tokens
     42 {
     43     meta:
     44         sharing = "TLP:CLEAR"
     45         author = "MTRNord"
     46         description = "This detects npm access tokens."
     47         Action = "RedactAndNotify"
     48         NotifcationText = "NPM access token detected. Please remove and revoke(!) it before sending your message again. If this is a falsepositive make sure to include `tokenbypass1CwRlV5VtQdDPh`"
     49     strings:
     50         $access_token = /npm_[A-Za-z0-9]{1,255}/ ascii fullword
     51         $bypass = "tokenbypass1CwRlV5VtQdDPh" ascii fullword
     52         $underscore = "_" ascii	       
     53     condition:
     54         ($access_token and #underscore == 1) and not $bypass
     55 }