Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Mass import not committing YARA rules #440

Open
PhilOrdo opened this issue Oct 17, 2022 · 0 comments
Open

Mass import not committing YARA rules #440

PhilOrdo opened this issue Oct 17, 2022 · 0 comments

Comments

@PhilOrdo
Copy link
Contributor

Extracting YARA rules via https://threatkb.inquest.net/#!/import fails to commit.
Rule this was occurring on:
`rule SUSP_certificate_payload {
meta:
description = "Detects payloads that pretend to be certificates"
date = "2018/08/02"
author = "Didier Stevens, Florian Roth"
reference = "https://blog.nviso.be/2018/08/02/powershell-inside-a-certificate-part-3/"
score = 50
strings:
$re1 = "-----BEGIN CERTIFICATE-----"

  $fp1 = "replace it with the PEM-encoded root certificate"

condition:
uint32(0) == 0x2D2D2D2D
and $re1 at 0
/* not 'M' at position 29, which is after the BEGIN CERTIFICATE header plus line break /
/
\r\n /
and not uint8(29) == 0x4D
/
\n /
and not uint8(28) == 0x4D
and not 1 of ($fp
)
}`

pedramamini added a commit that referenced this issue Oct 26, 2022
…ting-yara-rules

#440 : Fixing issue with import not committing due to numeric metadat…
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: Ready
Development

No branches or pull requests

1 participant