rule_github_greyware_tool_keyword

YARA detection rule by @mthcht · NOASSERTION
Detection patterns for the tool 'github' taken from the ThreatHunting-Keywords github project
rule rule_github_greyware_tool_keyword
{
    meta:
        description = "Detection patterns for the tool 'github' taken from the ThreatHunting-Keywords github project"
        author = "@mthcht"
        reference = "https://github.com/mthcht/ThreatHunting-Keywords"
        tool = "github"
        rule_category = "greyware_tool_keyword"

    strings:
                        $string1_github_greyware_tool_keyword = /\/github\.com.{0,100}\.exe\?raw\=true/ nocase ascii wide
                        $string2_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/archive\/refs\/tags\/.{0,100}\.zip/ nocase ascii wide
                        $string3_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.7z/ nocase ascii wide
                        $string4_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.apk/ nocase ascii wide
                        $string5_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.app/ nocase ascii wide
                        $string6_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.as/ nocase ascii wide
                        $string7_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.asc/ nocase ascii wide
                        $string8_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.asp/ nocase ascii wide
                        $string9_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.bash/
                        $string10_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.bat/ nocase ascii wide
                        $string11_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.beacon/ nocase ascii wide
                        $string12_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.bin/ nocase ascii wide
                        $string13_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.bpl/ nocase ascii wide
                        $string14_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.c/ nocase ascii wide
                        $string15_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.cer/ nocase ascii wide
                        $string16_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.cmd/ nocase ascii wide
                        $string17_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.com/ nocase ascii wide
                        $string18_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.cpp/ nocase ascii wide
                        $string19_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.crt/ nocase ascii wide
                        $string20_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.cs/ nocase ascii wide
                        $string21_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.csh/ nocase ascii wide
                        $string22_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.dat/ nocase ascii wide
                        $string23_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.dll/ nocase ascii wide
                        $string24_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.docm/ nocase ascii wide
                        $string25_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.dos/ nocase ascii wide
                        $string26_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.exe/ nocase ascii wide
                        $string27_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.go/ nocase ascii wide
                        $string28_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.gz/ nocase ascii wide
                        $string29_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.hta/ nocase ascii wide
                        $string30_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.iso/ nocase ascii wide
                        $string31_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.jar/ nocase ascii wide
                        $string32_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.js/ nocase ascii wide
                        $string33_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.lnk/ nocase ascii wide
                        $string34_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.log/ nocase ascii wide
                        $string35_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.mac/ nocase ascii wide
                        $string36_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.mam/ nocase ascii wide
                        $string37_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.msi/ nocase ascii wide
                        $string38_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.msp/ nocase ascii wide
                        $string39_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.nexe/ nocase ascii wide
                        $string40_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.nim/ nocase ascii wide
                        $string41_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.otm/ nocase ascii wide
                        $string42_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.out/ nocase ascii wide
                        $string43_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.ova/ nocase ascii wide
                        $string44_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.pem/ nocase ascii wide
                        $string45_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.pfx/ nocase ascii wide
                        $string46_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.pl/ nocase ascii wide
                        $string47_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.plx/ nocase ascii wide
                        $string48_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.pm/ nocase ascii wide
                        $string49_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.ppk/ nocase ascii wide
                        $string50_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.ps1/ nocase ascii wide
                        $string51_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.psm1/ nocase ascii wide
                        $string52_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.pub/ nocase ascii wide
                        $string53_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.py/ nocase ascii wide
                        $string54_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.pyc/ nocase ascii wide
                        $string55_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.pyo/ nocase ascii wide
                        $string56_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.rar/ nocase ascii wide
                        $string57_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.raw/ nocase ascii wide
                        $string58_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.reg/ nocase ascii wide
                        $string59_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.rgs/ nocase ascii wide
                        $string60_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.RGS/ nocase ascii wide
                        $string61_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.run/ nocase ascii wide
                        $string62_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.scpt/ nocase ascii wide
                        $string63_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.script/ nocase ascii wide
                        $string64_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.sct/ nocase ascii wide
                        $string65_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.sh/ nocase ascii wide
                        $string66_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.ssh/ nocase ascii wide
                        $string67_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.sys/ nocase ascii wide
                        $string68_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.teamserver/ nocase ascii wide
                        $string69_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.temp/ nocase ascii wide
                        $string70_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.tgz/ nocase ascii wide
                        $string71_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.tmp/ nocase ascii wide
                        $string72_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.vb/ nocase ascii wide
                        $string73_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.vbs/ nocase ascii wide
                        $string74_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.vbscript/ nocase ascii wide
                        $string75_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.ws/ nocase ascii wide
                        $string76_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.wsf/ nocase ascii wide
                        $string77_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.wsh/ nocase ascii wide
                        $string78_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.X86/ nocase ascii wide
                        $string79_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.X86_64/ nocase ascii wide
                        $string80_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.xlam/ nocase ascii wide
                        $string81_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.xlm/ nocase ascii wide
                        $string82_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.xlsm/ nocase ascii wide
                        $string83_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.zip/ nocase ascii wide
                        $string84_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.7z/ nocase ascii wide
                        $string85_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.apk/ nocase ascii wide
                        $string86_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.bat/ nocase ascii wide
                        $string87_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.cmd/ nocase ascii wide
                        $string88_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.com/ nocase ascii wide
                        $string89_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.cpl/ nocase ascii wide
                        $string90_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.dll/ nocase ascii wide
                        $string91_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.exe/ nocase ascii wide
                        $string92_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.hta/ nocase ascii wide
                        $string93_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.iso/ nocase ascii wide
                        $string94_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.jar/ nocase ascii wide
                        $string95_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.lnk/ nocase ascii wide
                        $string96_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.msi/ nocase ascii wide
                        $string97_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.pif/ nocase ascii wide
                        $string98_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.ps1/ nocase ascii wide
                        $string99_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.py/ nocase ascii wide
                        $string100_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.reg/ nocase ascii wide
                        $string101_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.scr/ nocase ascii wide
                        $string102_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.sh/ nocase ascii wide
                        $string103_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.vbs/ nocase ascii wide
                        $string104_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.vbs/ nocase ascii wide
                        $string105_github_greyware_tool_keyword = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.zip/ nocase ascii wide
                        $string106_github_greyware_tool_keyword = /codeload\.github\.com\// nocase ascii wide
                        $string107_github_greyware_tool_keyword = /https\:\/\/.{0,100}\.app\.github\.dev\// nocase ascii wide
                        $string108_github_greyware_tool_keyword = /objects\.githubusercontent\.com\/github\-production\-release\-asset\-/ nocase ascii wide
                        $string109_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.7z/ nocase ascii wide
                        $string110_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.apk/ nocase ascii wide
                        $string111_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.app/ nocase ascii wide
                        $string112_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.as/ nocase ascii wide
                        $string113_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.asc/ nocase ascii wide
                        $string114_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.asp/ nocase ascii wide
                        $string115_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.bash/
                        $string116_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.bat/ nocase ascii wide
                        $string117_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.beacon/ nocase ascii wide
                        $string118_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.bin/ nocase ascii wide
                        $string119_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.bpl/ nocase ascii wide
                        $string120_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.c/ nocase ascii wide
                        $string121_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.cer/ nocase ascii wide
                        $string122_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.cmd/ nocase ascii wide
                        $string123_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.com/ nocase ascii wide
                        $string124_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.cpp/ nocase ascii wide
                        $string125_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.crt/ nocase ascii wide
                        $string126_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.cs/ nocase ascii wide
                        $string127_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.csh/ nocase ascii wide
                        $string128_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.dat/ nocase ascii wide
                        $string129_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.dll/ nocase ascii wide
                        $string130_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.docm/ nocase ascii wide
                        $string131_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.dos/ nocase ascii wide
                        $string132_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.exe/ nocase ascii wide
                        $string133_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.go/ nocase ascii wide
                        $string134_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.gz/ nocase ascii wide
                        $string135_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.hta/ nocase ascii wide
                        $string136_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.iso/ nocase ascii wide
                        $string137_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.jar/ nocase ascii wide
                        $string138_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.js/ nocase ascii wide
                        $string139_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.lnk/ nocase ascii wide
                        $string140_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.log/ nocase ascii wide
                        $string141_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.mac/ nocase ascii wide
                        $string142_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.mam/ nocase ascii wide
                        $string143_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.msi/ nocase ascii wide
                        $string144_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.msp/ nocase ascii wide
                        $string145_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.nexe/ nocase ascii wide
                        $string146_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.nim/ nocase ascii wide
                        $string147_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.otm/ nocase ascii wide
                        $string148_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.out/ nocase ascii wide
                        $string149_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.ova/ nocase ascii wide
                        $string150_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.pem/ nocase ascii wide
                        $string151_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.pfx/ nocase ascii wide
                        $string152_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.pl/ nocase ascii wide
                        $string153_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.plx/ nocase ascii wide
                        $string154_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.pm/ nocase ascii wide
                        $string155_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.ppk/ nocase ascii wide
                        $string156_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.ps1/ nocase ascii wide
                        $string157_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.psm1/ nocase ascii wide
                        $string158_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.pub/ nocase ascii wide
                        $string159_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.py/ nocase ascii wide
                        $string160_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.pyc/ nocase ascii wide
                        $string161_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.pyo/ nocase ascii wide
                        $string162_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.rar/ nocase ascii wide
                        $string163_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.raw/ nocase ascii wide
                        $string164_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.reg/ nocase ascii wide
                        $string165_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.rgs/ nocase ascii wide
                        $string166_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.RGS/ nocase ascii wide
                        $string167_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.run/ nocase ascii wide
                        $string168_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.scpt/ nocase ascii wide
                        $string169_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.script/ nocase ascii wide
                        $string170_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.sct/ nocase ascii wide
                        $string171_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.sh/ nocase ascii wide
                        $string172_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.ssh/ nocase ascii wide
                        $string173_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.sys/ nocase ascii wide
                        $string174_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.teamserver/ nocase ascii wide
                        $string175_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.temp/ nocase ascii wide
                        $string176_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.tgz/ nocase ascii wide
                        $string177_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.tmp/ nocase ascii wide
                        $string178_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.vb/ nocase ascii wide
                        $string179_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.vbs/ nocase ascii wide
                        $string180_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.vbscript/ nocase ascii wide
                        $string181_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.ws/ nocase ascii wide
                        $string182_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.wsf/ nocase ascii wide
                        $string183_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.wsh/ nocase ascii wide
                        $string184_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.X86/ nocase ascii wide
                        $string185_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.X86_64/ nocase ascii wide
                        $string186_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.xlam/ nocase ascii wide
                        $string187_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.xlm/ nocase ascii wide
                        $string188_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.xlsm/ nocase ascii wide
                        $string189_github_greyware_tool_keyword = /raw\.githubusercontent\.com.{0,100}\.zip/ nocase ascii wide
        $metadata_regex_import = /\bimport\s+[a-zA-Z0-9_.]+\b/ nocase
        $metadata_regex_function = /function\s+[a-zA-Z_][a-zA-Z0-9_]*\(/ nocase ascii
        $metadata_regex_php = /<\?php/ nocase ascii
        $metadata_regex_createobject = /(CreateObject|WScript\.)/ nocase ascii
        $metadata_regex_script = /<script\b/ nocase ascii
        $metadata_regex_javascript = /(let\s|const\s|function\s|document\.|console\.)/ nocase ascii
        $metadata_regex_powershell = /(Write-Host|Get-[a-zA-Z]+|Invoke-|param\(|\.SYNOPSIS)/ nocase ascii
        $metadata_regex_batch = /@(echo\s|call\s|set\s|goto\s|if\s|for\s|rem\s)/ nocase ascii
        $metadata_regex_shebang = /^#!\// nocase ascii

    condition:
        ((filesize < 20MB and (
            uint16(0) == 0x5a4d or             uint16(0) == 0x457f or             uint32be(0) == 0x7f454c46 or uint16(0) == 0xfeca or uint16(0) == 0xfacf or uint32(0) == 0xbebafeca or             uint32(0) == 0x504B0304 or             uint32(0) == 0xCAFEBABE or             uint32(0) == 0x4D534346 or             uint32(0) == 0xD0CF11E0 or             uint16(0) == 0x2321 or             uint16(0) == 0x3c3f         )) and 2 of ($string*)) or
        (filesize < 2MB and
        (
            2 of ($string*) and
            for any of ($metadata_regex_*) : ( @ <= 20000 )
        ))
}
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

22ae8b4c-9ed2-4e23-b836-b149e082240a
Propose edits, view related rules, and engage with the community through comments.
Executable code, not a declarative rule
This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.
Rejected pattern present
[[ reason ]]
What does this mean?
Format & documentation suggestions
Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.
[[ reason ]]
What do these messages mean?
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion
