github

YARA detection rule by @mthcht · NOASSERTION
Detection patterns for the tool 'github' taken from the ThreatHunting-Keywords github project
rule github
{
    meta:
        description = "Detection patterns for the tool 'github' taken from the ThreatHunting-Keywords github project"
        author = "@mthcht"
        reference = "https://github.com/mthcht/ThreatHunting-Keywords"
        tool = "github"
        rule_category = "greyware_tool_keyword"

    strings:
                        $string1 = /\/github\.com.{0,1000}\.exe\?raw\=true/ nocase ascii wide
                        $string2 = /\/github\.com\/.{0,1000}\/archive\/refs\/tags\/.{0,1000}\.zip/ nocase ascii wide
                        $string3 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.7z/ nocase ascii wide
                        $string4 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.apk/ nocase ascii wide
                        $string5 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.app/ nocase ascii wide
                        $string6 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.as/ nocase ascii wide
                        $string7 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.asc/ nocase ascii wide
                        $string8 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.asp/ nocase ascii wide
                        $string9 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.bash/
                        $string10 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.bat/ nocase ascii wide
                        $string11 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.beacon/ nocase ascii wide
                        $string12 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.bin/ nocase ascii wide
                        $string13 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.bpl/ nocase ascii wide
                        $string14 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.c/ nocase ascii wide
                        $string15 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.cer/ nocase ascii wide
                        $string16 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.cmd/ nocase ascii wide
                        $string17 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.com/ nocase ascii wide
                        $string18 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.cpp/ nocase ascii wide
                        $string19 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.crt/ nocase ascii wide
                        $string20 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.cs/ nocase ascii wide
                        $string21 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.csh/ nocase ascii wide
                        $string22 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.dat/ nocase ascii wide
                        $string23 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.dll/ nocase ascii wide
                        $string24 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.docm/ nocase ascii wide
                        $string25 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.dos/ nocase ascii wide
                        $string26 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.exe/ nocase ascii wide
                        $string27 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.go/ nocase ascii wide
                        $string28 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.gz/ nocase ascii wide
                        $string29 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.hta/ nocase ascii wide
                        $string30 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.iso/ nocase ascii wide
                        $string31 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.jar/ nocase ascii wide
                        $string32 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.js/ nocase ascii wide
                        $string33 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.lnk/ nocase ascii wide
                        $string34 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.log/ nocase ascii wide
                        $string35 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.mac/ nocase ascii wide
                        $string36 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.mam/ nocase ascii wide
                        $string37 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.msi/ nocase ascii wide
                        $string38 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.msp/ nocase ascii wide
                        $string39 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.nexe/ nocase ascii wide
                        $string40 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.nim/ nocase ascii wide
                        $string41 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.otm/ nocase ascii wide
                        $string42 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.out/ nocase ascii wide
                        $string43 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.ova/ nocase ascii wide
                        $string44 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.pem/ nocase ascii wide
                        $string45 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.pfx/ nocase ascii wide
                        $string46 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.pl/ nocase ascii wide
                        $string47 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.plx/ nocase ascii wide
                        $string48 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.pm/ nocase ascii wide
                        $string49 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.ppk/ nocase ascii wide
                        $string50 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.ps1/ nocase ascii wide
                        $string51 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.psm1/ nocase ascii wide
                        $string52 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.pub/ nocase ascii wide
                        $string53 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.py/ nocase ascii wide
                        $string54 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.pyc/ nocase ascii wide
                        $string55 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.pyo/ nocase ascii wide
                        $string56 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.rar/ nocase ascii wide
                        $string57 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.raw/ nocase ascii wide
                        $string58 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.reg/ nocase ascii wide
                        $string59 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.rgs/ nocase ascii wide
                        $string60 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.RGS/ nocase ascii wide
                        $string61 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.run/ nocase ascii wide
                        $string62 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.scpt/ nocase ascii wide
                        $string63 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.script/ nocase ascii wide
                        $string64 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.sct/ nocase ascii wide
                        $string65 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.sh/ nocase ascii wide
                        $string66 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.ssh/ nocase ascii wide
                        $string67 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.sys/ nocase ascii wide
                        $string68 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.teamserver/ nocase ascii wide
                        $string69 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.temp/ nocase ascii wide
                        $string70 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.tgz/ nocase ascii wide
                        $string71 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.tmp/ nocase ascii wide
                        $string72 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.vb/ nocase ascii wide
                        $string73 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.vbs/ nocase ascii wide
                        $string74 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.vbscript/ nocase ascii wide
                        $string75 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.ws/ nocase ascii wide
                        $string76 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.wsf/ nocase ascii wide
                        $string77 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.wsh/ nocase ascii wide
                        $string78 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.X86/ nocase ascii wide
                        $string79 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.X86_64/ nocase ascii wide
                        $string80 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.xlam/ nocase ascii wide
                        $string81 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.xlm/ nocase ascii wide
                        $string82 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.xlsm/ nocase ascii wide
                        $string83 = /\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.zip/ nocase ascii wide
                        $string84 = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.7z/ nocase ascii wide
                        $string85 = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.apk/ nocase ascii wide
                        $string86 = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.bat/ nocase ascii wide
                        $string87 = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.cmd/ nocase ascii wide
                        $string88 = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.com/ nocase ascii wide
                        $string89 = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.cpl/ nocase ascii wide
                        $string90 = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.dll/ nocase ascii wide
                        $string91 = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.exe/ nocase ascii wide
                        $string92 = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.hta/ nocase ascii wide
                        $string93 = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.iso/ nocase ascii wide
                        $string94 = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.jar/ nocase ascii wide
                        $string95 = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.lnk/ nocase ascii wide
                        $string96 = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.msi/ nocase ascii wide
                        $string97 = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.pif/ nocase ascii wide
                        $string98 = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.ps1/ nocase ascii wide
                        $string99 = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.py/ nocase ascii wide
                        $string100 = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.reg/ nocase ascii wide
                        $string101 = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.scr/ nocase ascii wide
                        $string102 = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.sh/ nocase ascii wide
                        $string103 = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.vbs/ nocase ascii wide
                        $string104 = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.vbs/ nocase ascii wide
                        $string105 = /\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.zip/ nocase ascii wide
                        $string106 = /codeload\.github\.com\// nocase ascii wide
                        $string107 = /https\:\/\/.{0,1000}\.app\.github\.dev\// nocase ascii wide
                        $string108 = /objects\.githubusercontent\.com\/github\-production\-release\-asset\-/ nocase ascii wide
                        $string109 = /raw\.githubusercontent\.com.{0,1000}\.7z/ nocase ascii wide
                        $string110 = /raw\.githubusercontent\.com.{0,1000}\.apk/ nocase ascii wide
                        $string111 = /raw\.githubusercontent\.com.{0,1000}\.app/ nocase ascii wide
                        $string112 = /raw\.githubusercontent\.com.{0,1000}\.as/ nocase ascii wide
                        $string113 = /raw\.githubusercontent\.com.{0,1000}\.asc/ nocase ascii wide
                        $string114 = /raw\.githubusercontent\.com.{0,1000}\.asp/ nocase ascii wide
                        $string115 = /raw\.githubusercontent\.com.{0,1000}\.bash/
                        $string116 = /raw\.githubusercontent\.com.{0,1000}\.bat/ nocase ascii wide
                        $string117 = /raw\.githubusercontent\.com.{0,1000}\.beacon/ nocase ascii wide
                        $string118 = /raw\.githubusercontent\.com.{0,1000}\.bin/ nocase ascii wide
                        $string119 = /raw\.githubusercontent\.com.{0,1000}\.bpl/ nocase ascii wide
                        $string120 = /raw\.githubusercontent\.com.{0,1000}\.c/ nocase ascii wide
                        $string121 = /raw\.githubusercontent\.com.{0,1000}\.cer/ nocase ascii wide
                        $string122 = /raw\.githubusercontent\.com.{0,1000}\.cmd/ nocase ascii wide
                        $string123 = /raw\.githubusercontent\.com.{0,1000}\.com/ nocase ascii wide
                        $string124 = /raw\.githubusercontent\.com.{0,1000}\.cpp/ nocase ascii wide
                        $string125 = /raw\.githubusercontent\.com.{0,1000}\.crt/ nocase ascii wide
                        $string126 = /raw\.githubusercontent\.com.{0,1000}\.cs/ nocase ascii wide
                        $string127 = /raw\.githubusercontent\.com.{0,1000}\.csh/ nocase ascii wide
                        $string128 = /raw\.githubusercontent\.com.{0,1000}\.dat/ nocase ascii wide
                        $string129 = /raw\.githubusercontent\.com.{0,1000}\.dll/ nocase ascii wide
                        $string130 = /raw\.githubusercontent\.com.{0,1000}\.docm/ nocase ascii wide
                        $string131 = /raw\.githubusercontent\.com.{0,1000}\.dos/ nocase ascii wide
                        $string132 = /raw\.githubusercontent\.com.{0,1000}\.exe/ nocase ascii wide
                        $string133 = /raw\.githubusercontent\.com.{0,1000}\.go/ nocase ascii wide
                        $string134 = /raw\.githubusercontent\.com.{0,1000}\.gz/ nocase ascii wide
                        $string135 = /raw\.githubusercontent\.com.{0,1000}\.hta/ nocase ascii wide
                        $string136 = /raw\.githubusercontent\.com.{0,1000}\.iso/ nocase ascii wide
                        $string137 = /raw\.githubusercontent\.com.{0,1000}\.jar/ nocase ascii wide
                        $string138 = /raw\.githubusercontent\.com.{0,1000}\.js/ nocase ascii wide
                        $string139 = /raw\.githubusercontent\.com.{0,1000}\.lnk/ nocase ascii wide
                        $string140 = /raw\.githubusercontent\.com.{0,1000}\.log/ nocase ascii wide
                        $string141 = /raw\.githubusercontent\.com.{0,1000}\.mac/ nocase ascii wide
                        $string142 = /raw\.githubusercontent\.com.{0,1000}\.mam/ nocase ascii wide
                        $string143 = /raw\.githubusercontent\.com.{0,1000}\.msi/ nocase ascii wide
                        $string144 = /raw\.githubusercontent\.com.{0,1000}\.msp/ nocase ascii wide
                        $string145 = /raw\.githubusercontent\.com.{0,1000}\.nexe/ nocase ascii wide
                        $string146 = /raw\.githubusercontent\.com.{0,1000}\.nim/ nocase ascii wide
                        $string147 = /raw\.githubusercontent\.com.{0,1000}\.otm/ nocase ascii wide
                        $string148 = /raw\.githubusercontent\.com.{0,1000}\.out/ nocase ascii wide
                        $string149 = /raw\.githubusercontent\.com.{0,1000}\.ova/ nocase ascii wide
                        $string150 = /raw\.githubusercontent\.com.{0,1000}\.pem/ nocase ascii wide
                        $string151 = /raw\.githubusercontent\.com.{0,1000}\.pfx/ nocase ascii wide
                        $string152 = /raw\.githubusercontent\.com.{0,1000}\.pl/ nocase ascii wide
                        $string153 = /raw\.githubusercontent\.com.{0,1000}\.plx/ nocase ascii wide
                        $string154 = /raw\.githubusercontent\.com.{0,1000}\.pm/ nocase ascii wide
                        $string155 = /raw\.githubusercontent\.com.{0,1000}\.ppk/ nocase ascii wide
                        $string156 = /raw\.githubusercontent\.com.{0,1000}\.ps1/ nocase ascii wide
                        $string157 = /raw\.githubusercontent\.com.{0,1000}\.psm1/ nocase ascii wide
                        $string158 = /raw\.githubusercontent\.com.{0,1000}\.pub/ nocase ascii wide
                        $string159 = /raw\.githubusercontent\.com.{0,1000}\.py/ nocase ascii wide
                        $string160 = /raw\.githubusercontent\.com.{0,1000}\.pyc/ nocase ascii wide
                        $string161 = /raw\.githubusercontent\.com.{0,1000}\.pyo/ nocase ascii wide
                        $string162 = /raw\.githubusercontent\.com.{0,1000}\.rar/ nocase ascii wide
                        $string163 = /raw\.githubusercontent\.com.{0,1000}\.raw/ nocase ascii wide
                        $string164 = /raw\.githubusercontent\.com.{0,1000}\.reg/ nocase ascii wide
                        $string165 = /raw\.githubusercontent\.com.{0,1000}\.rgs/ nocase ascii wide
                        $string166 = /raw\.githubusercontent\.com.{0,1000}\.RGS/ nocase ascii wide
                        $string167 = /raw\.githubusercontent\.com.{0,1000}\.run/ nocase ascii wide
                        $string168 = /raw\.githubusercontent\.com.{0,1000}\.scpt/ nocase ascii wide
                        $string169 = /raw\.githubusercontent\.com.{0,1000}\.script/ nocase ascii wide
                        $string170 = /raw\.githubusercontent\.com.{0,1000}\.sct/ nocase ascii wide
                        $string171 = /raw\.githubusercontent\.com.{0,1000}\.sh/ nocase ascii wide
                        $string172 = /raw\.githubusercontent\.com.{0,1000}\.ssh/ nocase ascii wide
                        $string173 = /raw\.githubusercontent\.com.{0,1000}\.sys/ nocase ascii wide
                        $string174 = /raw\.githubusercontent\.com.{0,1000}\.teamserver/ nocase ascii wide
                        $string175 = /raw\.githubusercontent\.com.{0,1000}\.temp/ nocase ascii wide
                        $string176 = /raw\.githubusercontent\.com.{0,1000}\.tgz/ nocase ascii wide
                        $string177 = /raw\.githubusercontent\.com.{0,1000}\.tmp/ nocase ascii wide
                        $string178 = /raw\.githubusercontent\.com.{0,1000}\.vb/ nocase ascii wide
                        $string179 = /raw\.githubusercontent\.com.{0,1000}\.vbs/ nocase ascii wide
                        $string180 = /raw\.githubusercontent\.com.{0,1000}\.vbscript/ nocase ascii wide
                        $string181 = /raw\.githubusercontent\.com.{0,1000}\.ws/ nocase ascii wide
                        $string182 = /raw\.githubusercontent\.com.{0,1000}\.wsf/ nocase ascii wide
                        $string183 = /raw\.githubusercontent\.com.{0,1000}\.wsh/ nocase ascii wide
                        $string184 = /raw\.githubusercontent\.com.{0,1000}\.X86/ nocase ascii wide
                        $string185 = /raw\.githubusercontent\.com.{0,1000}\.X86_64/ nocase ascii wide
                        $string186 = /raw\.githubusercontent\.com.{0,1000}\.xlam/ nocase ascii wide
                        $string187 = /raw\.githubusercontent\.com.{0,1000}\.xlm/ nocase ascii wide
                        $string188 = /raw\.githubusercontent\.com.{0,1000}\.xlsm/ nocase ascii wide
                        $string189 = /raw\.githubusercontent\.com.{0,1000}\.zip/ nocase ascii wide

    condition:
        any of them
}
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

91196450-1b67-42a4-a491-9e7b9fb8e1e8
Propose edits, view related rules, and engage with the community through comments.
Executable code, not a declarative rule
This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.
Rejected pattern present
[[ reason ]]
What does this mean?
Format & documentation suggestions
Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.
[[ reason ]]
What do these messages mean?
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion
