node-yara-rs

git clone git://archive.git.mtrnord.blog/MTRNord/node-yara-rs.git
Log | Files | Refs | README | LICENSE

json_test.yara (1761B)

      1 import "json"
      2 
      3 rule string_array_includes {
      4     condition:
      5         json.array_includes("strArray", "one") and
      6         json.array_includes("strArray", "two") and
      7         json.array_includes("strArray", "three")
      8 }
      9 
     10 rule string_array_includes_nested {
     11     condition:
     12         json.array_includes("string.strArray", "one") and
     13         json.array_includes("string.strArray", "two") and
     14         json.array_includes("string.strArray", "three")
     15 }
     16 
     17 rule integer_array_includes {
     18     condition:
     19         json.array_includes("intArray", 1) and
     20         json.array_includes("intArray", 2) and
     21         json.array_includes("intArray", 3)
     22 }
     23 
     24 rule integer_array_includes_nested {
     25     condition:
     26         json.array_includes("integer.intArray", 1) and
     27         json.array_includes("integer.intArray", 2) and
     28         json.array_includes("integer.intArray", 3)
     29 }
     30 
     31 rule float_array_includes {
     32     condition:
     33         json.array_includes("floatArray", 1.0) and
     34         json.array_includes("floatArray", 2.0) and
     35         json.array_includes("floatArray", 3.0)
     36 }
     37 
     38 rule float_array_includes_nested {
     39     condition:
     40         json.array_includes("float.floatArray", 1.0) and
     41         json.array_includes("float.floatArray", 2.0) and
     42         json.array_includes("float.floatArray", 3.0)
     43 }
     44 
     45 rule dotted_key {
     46     condition:
     47         json.key_exists("dot\\.key")
     48 }
     49 
     50 rule dotted_key_sub {
     51     condition:
     52         json.key_exists("dot\\.key.subkey")
     53 }
     54 
     55 rule has_key_normal {
     56     condition:
     57         json.key_exists("normal_key")
     58 }
     59 
     60 rule get_string {
     61     condition:
     62         json.get_string_value("keykey") == "valuevalue"
     63 }
     64 
     65 rule get_integer {
     66     condition:
     67         json.get_integer_value("integer_number") == 42
     68 }
     69 
     70 rule get_float {
     71     condition:
     72         json.get_float_value("float_number") == 42.42
     73 }