FP's because of \x##\x##\x## in Yara rules
jeroenvermeulen opened this issue · 2 comments
Last night MageSec's rules were updated:
https://magesec.org/download/yara-standard.yar
A Yara rule like this:
rule ccsave_cc_number_3803e
{
strings: $ = "\x63\x63\x73\x61\x76\x65\x5F\x63\x63\x5F\x6E\x75\x6D\x62\x65\x72"
condition: any of them
}
Also matches the text ccsave_cc_number
which is what you get when you do in Bash:
echo -e "\x63\x63\x73\x61\x76\x65\x5F\x63\x63\x5F\x6E\x75\x6D\x62\x65\x72"
The solutions is to use a rule like this:
rule ccsave_cc_number_3803e_new
{
strings: $ = "\\x63\\x63\\x73\\x61\\x76\\x65\\x5F\\x63\\x63\\x5F\\x6E\\x75\\x6D\\x62\\x65\\x72"
condition: any of them
}
to match a file which includes the string \x63\x63\x73\x61\x76\x65\x5F\x63\x63\x5F\x6E\x75\x6D\x62\x65\x72
.
Is the intention of rule to identify the string of hex values, or to identify a string using the hex - which according to the Yara docs should normally be written as
strings: $ = { 63 63 73 61 76 65 5F 63 63 5F 6E 75 6D 62 65 72 }
If the former, which is most likely the case, then I agree with you that your revised rule would identify the hex string.
That seems to be an erroneous import by Martin Pachol (he syncs this repo periodically to Magesec). /cc @gnuzealot. The original rule here is correct (otherwise it wouldn't pass CI).