Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Draft] Protection to apply YARA Rules #139

Draft
wants to merge 16 commits into
base: main
Choose a base branch
from

Conversation

MTRNord
Copy link
Collaborator

@MTRNord MTRNord commented Oct 4, 2023

This adds a new protection.

This protection is utilizing https://github.com/VirusTotal/yara/ for a condition based pattern detection mechanism.

Its still fairly early into the work but some things for example are rules like https://github.com/MTRNord/matrix-yararules/blob/main/rules/detect_tokens.yara which then do this:

image

(the initial message was a text file with a synapse and a github token)

Things it adds:

  • A way to define simple and complex pattern matching rules
  • A way to define actions taken when these match
  • Matching of json constructs via the methods available using https://github.com/JeromeHadorn/YARA-JSON

Things planned but missing:

  • Disabling rules based on tag groups
  • Runtime reloading of rules

As usual: Please note that this is NOT production ready in any way. Also please read up on things like https://www.cisa.gov/news-events/news/traffic-light-protocol-tlp-definitions-and-usage before usage since these rules can also be used against you if they are public.

@MTRNord MTRNord force-pushed the MTRNord/yara-protections branch 3 times, most recently from 1bd43ab to 73b81be Compare October 14, 2023 13:49
@MTRNord MTRNord force-pushed the MTRNord/yara-protections branch 9 times, most recently from 1a9cc52 to a5d86cc Compare October 14, 2023 16:31
@MTRNord MTRNord mentioned this pull request Oct 20, 2023
9 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant