Skip to content

Instantly share code, notes, and snippets.

@edeca
Last active January 6, 2023 02:13
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save edeca/744cd25e4f6dda08ad777e4371de852e to your computer and use it in GitHub Desktop.
Save edeca/744cd25e4f6dda08ad777e4371de852e to your computer and use it in GitHub Desktop.
Yara rule to find a string near to other strings
import "math"
rule example {
meta:
author = "David Cannings"
description = "Rule example - finding a chunk of code near other known code"
strings:
$chunk = { AA BB CC DD }
$chunk_prologue = { 11 22 33 44 }
$chunk_epilogue = { FF EE DD CC }
condition:
for 5 i in (1..math.min(#chunk, 50)) : (
for any j in (1..math.min(#chunk_prologue, 50)) : (
@chunk[i] > @chunk_prologue[j] and
@chunk[i] - @chunk_prologue[j] < 20 and
@chunk[i] - @chunk_prologue[j] > 0 and
)
and
for any k in (1..math.min(#chunk_epilogue, 50)) : (
@chunk[i] < @chunk_epilogue[k] and
@chunk_epilogue[k] - @chunk[i] < 20 and
@chunk_epilogue[k] - @chunk[i] > 0
)
)
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment