rule_github_greyware_tool_keyword

YARA detection rule by @mthcht · NOASSERTION
Detection patterns for the tool 'github' taken from the ThreatHunting-Keywords github project
rule rule_github_greyware_tool_keyword
{
    meta:
        description = "Detection patterns for the tool 'github' taken from the ThreatHunting-Keywords github project"
        author = "@mthcht"
        reference = "https://github.com/mthcht/ThreatHunting-Keywords"
        tool = "github"
        rule_category = "greyware_tool_keyword"

    strings:
                        $string1_github_greyware_tool_keyword = /\/github\.com.{0,1000}\.exe\?raw\=true/ nocase ascii wide
                        $string2_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/archive\/refs\/tags\/.{0,1000}\.zip/ nocase ascii wide
                        $string3_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.7z/ nocase ascii wide
                        $string4_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.apk/ nocase ascii wide
                        $string5_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.app/ nocase ascii wide
                        $string6_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.as/ nocase ascii wide
                        $string7_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.asc/ nocase ascii wide
                        $string8_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.asp/ nocase ascii wide
                        $string9_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.bash/
                        $string10_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.bat/ nocase ascii wide
                        $string11_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.beacon/ nocase ascii wide
                        $string12_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.bin/ nocase ascii wide
                        $string13_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.bpl/ nocase ascii wide
                        $string14_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.c/ nocase ascii wide
                        $string15_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.cer/ nocase ascii wide
                        $string16_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.cmd/ nocase ascii wide
                        $string17_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.com/ nocase ascii wide
                        $string18_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.cpp/ nocase ascii wide
                        $string19_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.crt/ nocase ascii wide
                        $string20_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.cs/ nocase ascii wide
                        $string21_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.csh/ nocase ascii wide
                        $string22_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.dat/ nocase ascii wide
                        $string23_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.dll/ nocase ascii wide
                        $string24_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.docm/ nocase ascii wide
                        $string25_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.dos/ nocase ascii wide
                        $string26_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.exe/ nocase ascii wide
                        $string27_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.go/ nocase ascii wide
                        $string28_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.gz/ nocase ascii wide
                        $string29_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.hta/ nocase ascii wide
                        $string30_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.iso/ nocase ascii wide
                        $string31_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.jar/ nocase ascii wide
                        $string32_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.js/ nocase ascii wide
                        $string33_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.lnk/ nocase ascii wide
                        $string34_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.log/ nocase ascii wide
                        $string35_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.mac/ nocase ascii wide
                        $string36_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.mam/ nocase ascii wide
                        $string37_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.msi/ nocase ascii wide
                        $string38_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.msp/ nocase ascii wide
                        $string39_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.nexe/ nocase ascii wide
                        $string40_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.nim/ nocase ascii wide
                        $string41_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.otm/ nocase ascii wide
                        $string42_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.out/ nocase ascii wide
                        $string43_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.ova/ nocase ascii wide
                        $string44_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.pem/ nocase ascii wide
                        $string45_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.pfx/ nocase ascii wide
                        $string46_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.pl/ nocase ascii wide
                        $string47_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.plx/ nocase ascii wide
                        $string48_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.pm/ nocase ascii wide
                        $string49_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.ppk/ nocase ascii wide
                        $string50_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.ps1/ nocase ascii wide
                        $string51_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.psm1/ nocase ascii wide
                        $string52_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.pub/ nocase ascii wide
                        $string53_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.py/ nocase ascii wide
                        $string54_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.pyc/ nocase ascii wide
                        $string55_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.pyo/ nocase ascii wide
                        $string56_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.rar/ nocase ascii wide
                        $string57_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.raw/ nocase ascii wide
                        $string58_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.reg/ nocase ascii wide
                        $string59_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.rgs/ nocase ascii wide
                        $string60_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.RGS/ nocase ascii wide
                        $string61_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.run/ nocase ascii wide
                        $string62_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.scpt/ nocase ascii wide
                        $string63_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.script/ nocase ascii wide
                        $string64_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.sct/ nocase ascii wide
                        $string65_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.sh/ nocase ascii wide
                        $string66_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.ssh/ nocase ascii wide
                        $string67_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.sys/ nocase ascii wide
                        $string68_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.teamserver/ nocase ascii wide
                        $string69_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.temp/ nocase ascii wide
                        $string70_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.tgz/ nocase ascii wide
                        $string71_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.tmp/ nocase ascii wide
                        $string72_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.vb/ nocase ascii wide
                        $string73_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.vbs/ nocase ascii wide
                        $string74_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.vbscript/ nocase ascii wide
                        $string75_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.ws/ nocase ascii wide
                        $string76_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.wsf/ nocase ascii wide
                        $string77_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.wsh/ nocase ascii wide
                        $string78_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.X86/ nocase ascii wide
                        $string79_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.X86_64/ nocase ascii wide
                        $string80_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.xlam/ nocase ascii wide
                        $string81_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.xlm/ nocase ascii wide
                        $string82_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.xlsm/ nocase ascii wide
                        $string83_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.zip/ nocase ascii wide
                        $string84_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.7z/ nocase ascii wide
                        $string85_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.apk/ nocase ascii wide
                        $string86_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.bat/ nocase ascii wide
                        $string87_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.cmd/ nocase ascii wide
                        $string88_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.com/ nocase ascii wide
                        $string89_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.cpl/ nocase ascii wide
                        $string90_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.dll/ nocase ascii wide
                        $string91_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.exe/ nocase ascii wide
                        $string92_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.hta/ nocase ascii wide
                        $string93_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.iso/ nocase ascii wide
                        $string94_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.jar/ nocase ascii wide
                        $string95_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.lnk/ nocase ascii wide
                        $string96_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.msi/ nocase ascii wide
                        $string97_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.pif/ nocase ascii wide
                        $string98_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.ps1/ nocase ascii wide
                        $string99_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.py/ nocase ascii wide
                        $string100_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.reg/ nocase ascii wide
                        $string101_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.scr/ nocase ascii wide
                        $string102_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.sh/ nocase ascii wide
                        $string103_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.vbs/ nocase ascii wide
                        $string104_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.vbs/ nocase ascii wide
                        $string105_github_greyware_tool_keyword = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.zip/ nocase ascii wide
                        $string106_github_greyware_tool_keyword = /codeload\.github\.com\// nocase ascii wide
                        $string107_github_greyware_tool_keyword = /https\:\/\/.{0,1000}\.app\.github\.dev\// nocase ascii wide
                        $string108_github_greyware_tool_keyword = /objects\.githubusercontent\.com\/github\-production\-release\-asset\-/ nocase ascii wide
                        $string109_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.7z/ nocase ascii wide
                        $string110_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.apk/ nocase ascii wide
                        $string111_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.app/ nocase ascii wide
                        $string112_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.as/ nocase ascii wide
                        $string113_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.asc/ nocase ascii wide
                        $string114_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.asp/ nocase ascii wide
                        $string115_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.bash/
                        $string116_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.bat/ nocase ascii wide
                        $string117_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.beacon/ nocase ascii wide
                        $string118_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.bin/ nocase ascii wide
                        $string119_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.bpl/ nocase ascii wide
                        $string120_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.c/ nocase ascii wide
                        $string121_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.cer/ nocase ascii wide
                        $string122_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.cmd/ nocase ascii wide
                        $string123_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.com/ nocase ascii wide
                        $string124_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.cpp/ nocase ascii wide
                        $string125_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.crt/ nocase ascii wide
                        $string126_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.cs/ nocase ascii wide
                        $string127_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.csh/ nocase ascii wide
                        $string128_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.dat/ nocase ascii wide
                        $string129_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.dll/ nocase ascii wide
                        $string130_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.docm/ nocase ascii wide
                        $string131_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.dos/ nocase ascii wide
                        $string132_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.exe/ nocase ascii wide
                        $string133_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.go/ nocase ascii wide
                        $string134_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.gz/ nocase ascii wide
                        $string135_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.hta/ nocase ascii wide
                        $string136_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.iso/ nocase ascii wide
                        $string137_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.jar/ nocase ascii wide
                        $string138_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.js/ nocase ascii wide
                        $string139_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.lnk/ nocase ascii wide
                        $string140_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.log/ nocase ascii wide
                        $string141_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.mac/ nocase ascii wide
                        $string142_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.mam/ nocase ascii wide
                        $string143_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.msi/ nocase ascii wide
                        $string144_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.msp/ nocase ascii wide
                        $string145_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.nexe/ nocase ascii wide
                        $string146_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.nim/ nocase ascii wide
                        $string147_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.otm/ nocase ascii wide
                        $string148_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.out/ nocase ascii wide
                        $string149_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.ova/ nocase ascii wide
                        $string150_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.pem/ nocase ascii wide
                        $string151_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.pfx/ nocase ascii wide
                        $string152_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.pl/ nocase ascii wide
                        $string153_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.plx/ nocase ascii wide
                        $string154_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.pm/ nocase ascii wide
                        $string155_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.ppk/ nocase ascii wide
                        $string156_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.ps1/ nocase ascii wide
                        $string157_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.psm1/ nocase ascii wide
                        $string158_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.pub/ nocase ascii wide
                        $string159_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.py/ nocase ascii wide
                        $string160_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.pyc/ nocase ascii wide
                        $string161_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.pyo/ nocase ascii wide
                        $string162_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.rar/ nocase ascii wide
                        $string163_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.raw/ nocase ascii wide
                        $string164_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.reg/ nocase ascii wide
                        $string165_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.rgs/ nocase ascii wide
                        $string166_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.RGS/ nocase ascii wide
                        $string167_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.run/ nocase ascii wide
                        $string168_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.scpt/ nocase ascii wide
                        $string169_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.script/ nocase ascii wide
                        $string170_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.sct/ nocase ascii wide
                        $string171_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.sh/ nocase ascii wide
                        $string172_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.ssh/ nocase ascii wide
                        $string173_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.sys/ nocase ascii wide
                        $string174_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.teamserver/ nocase ascii wide
                        $string175_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.temp/ nocase ascii wide
                        $string176_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.tgz/ nocase ascii wide
                        $string177_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.tmp/ nocase ascii wide
                        $string178_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.vb/ nocase ascii wide
                        $string179_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.vbs/ nocase ascii wide
                        $string180_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.vbscript/ nocase ascii wide
                        $string181_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.ws/ nocase ascii wide
                        $string182_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.wsf/ nocase ascii wide
                        $string183_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.wsh/ nocase ascii wide
                        $string184_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.X86/ nocase ascii wide
                        $string185_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.X86_64/ nocase ascii wide
                        $string186_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.xlam/ nocase ascii wide
                        $string187_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.xlm/ nocase ascii wide
                        $string188_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.xlsm/ nocase ascii wide
                        $string189_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,1000}\.zip/ nocase ascii wide

    condition:
        any of them
}
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

6a2bcf12-47c0-4006-b936-81be047a8601
Propose edits, view related rules, and engage with the community through comments.
Executable code, not a declarative rule
This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.
Rejected pattern present
[[ reason ]]
What does this mean?
Format & documentation suggestions
Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.
[[ reason ]]
What do these messages mean?
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion
