blob: 081973fd09da7f928c2bd1c1fc210ee406ce1f9e (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
|
include "demobis.yar"
import "modname"
private global rule Test : tag1 tag2 {
meta:
desc_0 = "abc"
desc_1 = 123
desc_2 = true
desc_3 = false
desc_z = ""
strings:
$text = "value"
$text_b = "value" wide ascii fullword private xor(0x12)
$re = /hash: [0-9a-fA-F]{32}/
$re_b = /hash: [0-9a-fA-F]{32}/ wide ascii nocase fullword private
$hex = { AA bb [2-4] 61 62 63 }
$hex_b = { AA bb [2-4] 61 62 63 } private
condition:
filesize == 123 and entrypoint == 456 and for all of ($text*) : ( @ > @hex_b ) and any of them
}
|
