I’m writing a rule to detect scripts in Yara, but I want to cover all scripts as much as possible! ! Please help me.
rule Detect_Scripts {
strings:
$script_signature1 = "function" nocase
$script_signature2 = "var " nocase
$script_signature3 = "let " nocase
$script_signature4 = "const " nocase
$script_signature5 = "if " nocase
$script_signature6 = "else " nocase
$script_signature7 = "for " nocase
$script_signature8 = "while " nocase
$script_signature9 = "switch " nocase
$script_signature10 = "case " nocase
$script_signature11 = "def " nocase
$script_signature12 = "class " nocase
$script_signature13 = "import " nocase
$script_signature14 = "from " nocase
$script_signature15 = "$" nocase
$script_signature16 = "print " nocase
$script_signature17 = "echo " nocase
$script_signature18 = "<?php" nocase
$script_signature19 = "#!" nocase
$script_signature20 = "perl" nocase
$script_signature21 = "ruby" nocase
$script_signature22 = "bash" nocase
$script_signature23 = "sh" nocase
$script_siganture24 = "def " nocase
$script_siganture25 = "func " nocase
At the moment, I have written the rules as shown above, but if there is anything that is missing, bad, or needs to be added, please let me know.
New contributor
Taku is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.