github

YARA detection rule by @mthcht · NOASSERTION
Detection patterns for the tool 'github' taken from the ThreatHunting-Keywords github project
rule github
{
    meta:
        description = "Detection patterns for the tool 'github' taken from the ThreatHunting-Keywords github project"
        author = "@mthcht"
        reference = "https://github.com/mthcht/ThreatHunting-Keywords"
        tool = "github"
        rule_category = "greyware_tool_keyword"

    strings:
                        $string1 = /\/github\.com.{0,100}\.exe\?raw\=true/ nocase ascii wide
                        $string2 = /\/github\.com\/.{0,100}\/archive\/refs\/tags\/.{0,100}\.zip/ nocase ascii wide
                        $string3 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.7z/ nocase ascii wide
                        $string4 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.apk/ nocase ascii wide
                        $string5 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.app/ nocase ascii wide
                        $string6 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.as/ nocase ascii wide
                        $string7 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.asc/ nocase ascii wide
                        $string8 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.asp/ nocase ascii wide
                        $string9 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.bash/
                        $string10 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.bat/ nocase ascii wide
                        $string11 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.beacon/ nocase ascii wide
                        $string12 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.bin/ nocase ascii wide
                        $string13 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.bpl/ nocase ascii wide
                        $string14 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.c/ nocase ascii wide
                        $string15 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.cer/ nocase ascii wide
                        $string16 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.cmd/ nocase ascii wide
                        $string17 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.com/ nocase ascii wide
                        $string18 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.cpp/ nocase ascii wide
                        $string19 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.crt/ nocase ascii wide
                        $string20 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.cs/ nocase ascii wide
                        $string21 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.csh/ nocase ascii wide
                        $string22 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.dat/ nocase ascii wide
                        $string23 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.dll/ nocase ascii wide
                        $string24 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.docm/ nocase ascii wide
                        $string25 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.dos/ nocase ascii wide
                        $string26 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.exe/ nocase ascii wide
                        $string27 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.go/ nocase ascii wide
                        $string28 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.gz/ nocase ascii wide
                        $string29 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.hta/ nocase ascii wide
                        $string30 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.iso/ nocase ascii wide
                        $string31 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.jar/ nocase ascii wide
                        $string32 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.js/ nocase ascii wide
                        $string33 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.lnk/ nocase ascii wide
                        $string34 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.log/ nocase ascii wide
                        $string35 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.mac/ nocase ascii wide
                        $string36 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.mam/ nocase ascii wide
                        $string37 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.msi/ nocase ascii wide
                        $string38 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.msp/ nocase ascii wide
                        $string39 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.nexe/ nocase ascii wide
                        $string40 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.nim/ nocase ascii wide
                        $string41 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.otm/ nocase ascii wide
                        $string42 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.out/ nocase ascii wide
                        $string43 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.ova/ nocase ascii wide
                        $string44 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.pem/ nocase ascii wide
                        $string45 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.pfx/ nocase ascii wide
                        $string46 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.pl/ nocase ascii wide
                        $string47 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.plx/ nocase ascii wide
                        $string48 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.pm/ nocase ascii wide
                        $string49 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.ppk/ nocase ascii wide
                        $string50 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.ps1/ nocase ascii wide
                        $string51 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.psm1/ nocase ascii wide
                        $string52 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.pub/ nocase ascii wide
                        $string53 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.py/ nocase ascii wide
                        $string54 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.pyc/ nocase ascii wide
                        $string55 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.pyo/ nocase ascii wide
                        $string56 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.rar/ nocase ascii wide
                        $string57 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.raw/ nocase ascii wide
                        $string58 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.reg/ nocase ascii wide
                        $string59 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.rgs/ nocase ascii wide
                        $string60 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.RGS/ nocase ascii wide
                        $string61 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.run/ nocase ascii wide
                        $string62 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.scpt/ nocase ascii wide
                        $string63 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.script/ nocase ascii wide
                        $string64 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.sct/ nocase ascii wide
                        $string65 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.sh/ nocase ascii wide
                        $string66 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.ssh/ nocase ascii wide
                        $string67 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.sys/ nocase ascii wide
                        $string68 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.teamserver/ nocase ascii wide
                        $string69 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.temp/ nocase ascii wide
                        $string70 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.tgz/ nocase ascii wide
                        $string71 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.tmp/ nocase ascii wide
                        $string72 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.vb/ nocase ascii wide
                        $string73 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.vbs/ nocase ascii wide
                        $string74 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.vbscript/ nocase ascii wide
                        $string75 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.ws/ nocase ascii wide
                        $string76 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.wsf/ nocase ascii wide
                        $string77 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.wsh/ nocase ascii wide
                        $string78 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.X86/ nocase ascii wide
                        $string79 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.X86_64/ nocase ascii wide
                        $string80 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.xlam/ nocase ascii wide
                        $string81 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.xlm/ nocase ascii wide
                        $string82 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.xlsm/ nocase ascii wide
                        $string83 = /\/github\.com\/.{0,100}\/raw\/main\/.{0,100}\.zip/ nocase ascii wide
                        $string84 = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.7z/ nocase ascii wide
                        $string85 = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.apk/ nocase ascii wide
                        $string86 = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.bat/ nocase ascii wide
                        $string87 = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.cmd/ nocase ascii wide
                        $string88 = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.com/ nocase ascii wide
                        $string89 = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.cpl/ nocase ascii wide
                        $string90 = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.dll/ nocase ascii wide
                        $string91 = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.exe/ nocase ascii wide
                        $string92 = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.hta/ nocase ascii wide
                        $string93 = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.iso/ nocase ascii wide
                        $string94 = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.jar/ nocase ascii wide
                        $string95 = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.lnk/ nocase ascii wide
                        $string96 = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.msi/ nocase ascii wide
                        $string97 = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.pif/ nocase ascii wide
                        $string98 = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.ps1/ nocase ascii wide
                        $string99 = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.py/ nocase ascii wide
                        $string100 = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.reg/ nocase ascii wide
                        $string101 = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.scr/ nocase ascii wide
                        $string102 = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.sh/ nocase ascii wide
                        $string103 = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.vbs/ nocase ascii wide
                        $string104 = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.vbs/ nocase ascii wide
                        $string105 = /\/github\.com\/.{0,100}\/raw\/refs\/heads\/.{0,100}\.zip/ nocase ascii wide
                        $string106 = /codeload\.github\.com\// nocase ascii wide
                        $string107 = /https\:\/\/.{0,100}\.app\.github\.dev\// nocase ascii wide
                        $string108 = /objects\.githubusercontent\.com\/github\-production\-release\-asset\-/ nocase ascii wide
                        $string109 = /raw\.githubusercontent\.com.{0,100}\.7z/ nocase ascii wide
                        $string110 = /raw\.githubusercontent\.com.{0,100}\.apk/ nocase ascii wide
                        $string111 = /raw\.githubusercontent\.com.{0,100}\.app/ nocase ascii wide
                        $string112 = /raw\.githubusercontent\.com.{0,100}\.as/ nocase ascii wide
                        $string113 = /raw\.githubusercontent\.com.{0,100}\.asc/ nocase ascii wide
                        $string114 = /raw\.githubusercontent\.com.{0,100}\.asp/ nocase ascii wide
                        $string115 = /raw\.githubusercontent\.com.{0,100}\.bash/
                        $string116 = /raw\.githubusercontent\.com.{0,100}\.bat/ nocase ascii wide
                        $string117 = /raw\.githubusercontent\.com.{0,100}\.beacon/ nocase ascii wide
                        $string118 = /raw\.githubusercontent\.com.{0,100}\.bin/ nocase ascii wide
                        $string119 = /raw\.githubusercontent\.com.{0,100}\.bpl/ nocase ascii wide
                        $string120 = /raw\.githubusercontent\.com.{0,100}\.c/ nocase ascii wide
                        $string121 = /raw\.githubusercontent\.com.{0,100}\.cer/ nocase ascii wide
                        $string122 = /raw\.githubusercontent\.com.{0,100}\.cmd/ nocase ascii wide
                        $string123 = /raw\.githubusercontent\.com.{0,100}\.com/ nocase ascii wide
                        $string124 = /raw\.githubusercontent\.com.{0,100}\.cpp/ nocase ascii wide
                        $string125 = /raw\.githubusercontent\.com.{0,100}\.crt/ nocase ascii wide
                        $string126 = /raw\.githubusercontent\.com.{0,100}\.cs/ nocase ascii wide
                        $string127 = /raw\.githubusercontent\.com.{0,100}\.csh/ nocase ascii wide
                        $string128 = /raw\.githubusercontent\.com.{0,100}\.dat/ nocase ascii wide
                        $string129 = /raw\.githubusercontent\.com.{0,100}\.dll/ nocase ascii wide
                        $string130 = /raw\.githubusercontent\.com.{0,100}\.docm/ nocase ascii wide
                        $string131 = /raw\.githubusercontent\.com.{0,100}\.dos/ nocase ascii wide
                        $string132 = /raw\.githubusercontent\.com.{0,100}\.exe/ nocase ascii wide
                        $string133 = /raw\.githubusercontent\.com.{0,100}\.go/ nocase ascii wide
                        $string134 = /raw\.githubusercontent\.com.{0,100}\.gz/ nocase ascii wide
                        $string135 = /raw\.githubusercontent\.com.{0,100}\.hta/ nocase ascii wide
                        $string136 = /raw\.githubusercontent\.com.{0,100}\.iso/ nocase ascii wide
                        $string137 = /raw\.githubusercontent\.com.{0,100}\.jar/ nocase ascii wide
                        $string138 = /raw\.githubusercontent\.com.{0,100}\.js/ nocase ascii wide
                        $string139 = /raw\.githubusercontent\.com.{0,100}\.lnk/ nocase ascii wide
                        $string140 = /raw\.githubusercontent\.com.{0,100}\.log/ nocase ascii wide
                        $string141 = /raw\.githubusercontent\.com.{0,100}\.mac/ nocase ascii wide
                        $string142 = /raw\.githubusercontent\.com.{0,100}\.mam/ nocase ascii wide
                        $string143 = /raw\.githubusercontent\.com.{0,100}\.msi/ nocase ascii wide
                        $string144 = /raw\.githubusercontent\.com.{0,100}\.msp/ nocase ascii wide
                        $string145 = /raw\.githubusercontent\.com.{0,100}\.nexe/ nocase ascii wide
                        $string146 = /raw\.githubusercontent\.com.{0,100}\.nim/ nocase ascii wide
                        $string147 = /raw\.githubusercontent\.com.{0,100}\.otm/ nocase ascii wide
                        $string148 = /raw\.githubusercontent\.com.{0,100}\.out/ nocase ascii wide
                        $string149 = /raw\.githubusercontent\.com.{0,100}\.ova/ nocase ascii wide
                        $string150 = /raw\.githubusercontent\.com.{0,100}\.pem/ nocase ascii wide
                        $string151 = /raw\.githubusercontent\.com.{0,100}\.pfx/ nocase ascii wide
                        $string152 = /raw\.githubusercontent\.com.{0,100}\.pl/ nocase ascii wide
                        $string153 = /raw\.githubusercontent\.com.{0,100}\.plx/ nocase ascii wide
                        $string154 = /raw\.githubusercontent\.com.{0,100}\.pm/ nocase ascii wide
                        $string155 = /raw\.githubusercontent\.com.{0,100}\.ppk/ nocase ascii wide
                        $string156 = /raw\.githubusercontent\.com.{0,100}\.ps1/ nocase ascii wide
                        $string157 = /raw\.githubusercontent\.com.{0,100}\.psm1/ nocase ascii wide
                        $string158 = /raw\.githubusercontent\.com.{0,100}\.pub/ nocase ascii wide
                        $string159 = /raw\.githubusercontent\.com.{0,100}\.py/ nocase ascii wide
                        $string160 = /raw\.githubusercontent\.com.{0,100}\.pyc/ nocase ascii wide
                        $string161 = /raw\.githubusercontent\.com.{0,100}\.pyo/ nocase ascii wide
                        $string162 = /raw\.githubusercontent\.com.{0,100}\.rar/ nocase ascii wide
                        $string163 = /raw\.githubusercontent\.com.{0,100}\.raw/ nocase ascii wide
                        $string164 = /raw\.githubusercontent\.com.{0,100}\.reg/ nocase ascii wide
                        $string165 = /raw\.githubusercontent\.com.{0,100}\.rgs/ nocase ascii wide
                        $string166 = /raw\.githubusercontent\.com.{0,100}\.RGS/ nocase ascii wide
                        $string167 = /raw\.githubusercontent\.com.{0,100}\.run/ nocase ascii wide
                        $string168 = /raw\.githubusercontent\.com.{0,100}\.scpt/ nocase ascii wide
                        $string169 = /raw\.githubusercontent\.com.{0,100}\.script/ nocase ascii wide
                        $string170 = /raw\.githubusercontent\.com.{0,100}\.sct/ nocase ascii wide
                        $string171 = /raw\.githubusercontent\.com.{0,100}\.sh/ nocase ascii wide
                        $string172 = /raw\.githubusercontent\.com.{0,100}\.ssh/ nocase ascii wide
                        $string173 = /raw\.githubusercontent\.com.{0,100}\.sys/ nocase ascii wide
                        $string174 = /raw\.githubusercontent\.com.{0,100}\.teamserver/ nocase ascii wide
                        $string175 = /raw\.githubusercontent\.com.{0,100}\.temp/ nocase ascii wide
                        $string176 = /raw\.githubusercontent\.com.{0,100}\.tgz/ nocase ascii wide
                        $string177 = /raw\.githubusercontent\.com.{0,100}\.tmp/ nocase ascii wide
                        $string178 = /raw\.githubusercontent\.com.{0,100}\.vb/ nocase ascii wide
                        $string179 = /raw\.githubusercontent\.com.{0,100}\.vbs/ nocase ascii wide
                        $string180 = /raw\.githubusercontent\.com.{0,100}\.vbscript/ nocase ascii wide
                        $string181 = /raw\.githubusercontent\.com.{0,100}\.ws/ nocase ascii wide
                        $string182 = /raw\.githubusercontent\.com.{0,100}\.wsf/ nocase ascii wide
                        $string183 = /raw\.githubusercontent\.com.{0,100}\.wsh/ nocase ascii wide
                        $string184 = /raw\.githubusercontent\.com.{0,100}\.X86/ nocase ascii wide
                        $string185 = /raw\.githubusercontent\.com.{0,100}\.X86_64/ nocase ascii wide
                        $string186 = /raw\.githubusercontent\.com.{0,100}\.xlam/ nocase ascii wide
                        $string187 = /raw\.githubusercontent\.com.{0,100}\.xlm/ nocase ascii wide
                        $string188 = /raw\.githubusercontent\.com.{0,100}\.xlsm/ nocase ascii wide
                        $string189 = /raw\.githubusercontent\.com.{0,100}\.zip/ nocase ascii wide
        $metadata_regex_import = /\bimport\s+[a-zA-Z0-9_.]+\b/ nocase
        $metadata_regex_function = /function\s+[a-zA-Z_][a-zA-Z0-9_]*\(/ nocase ascii
        $metadata_regex_php = /<\?php/ nocase ascii
        $metadata_regex_createobject = /(CreateObject|WScript\.)/ nocase ascii
        $metadata_regex_script = /<script\b/ nocase ascii
        $metadata_regex_javascript = /(let\s|const\s|function\s|document\.|console\.)/ nocase ascii
        $metadata_regex_powershell = /(Write-Host|Get-[a-zA-Z]+|Invoke-|param\(|\.SYNOPSIS)/ nocase ascii
        $metadata_regex_batch = /@(echo\s|call\s|set\s|goto\s|if\s|for\s|rem\s)/ nocase ascii
        $metadata_regex_shebang = /^#!\// nocase ascii

    condition:
        ((filesize < 20MB and (
            uint16(0) == 0x5a4d or             uint16(0) == 0x457f or             uint32be(0) == 0x7f454c46 or uint16(0) == 0xfeca or uint16(0) == 0xfacf or uint32(0) == 0xbebafeca or             uint32(0) == 0x504B0304 or             uint32(0) == 0xCAFEBABE or             uint32(0) == 0x4D534346 or             uint32(0) == 0xD0CF11E0 or             uint16(0) == 0x2321 or             uint16(0) == 0x3c3f         )) and 2 of ($string*)) or
        (filesize < 2MB and
        (
            2 of ($string*) and
            for any of ($metadata_regex_*) : ( @ <= 20000 )
        ))
}
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

dad604bf-cc58-4557-b88a-635ed548e1a3
Propose edits, view related rules, and engage with the community through comments.
Executable code, not a declarative rule
This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.
Rejected pattern present
[[ reason ]]
What does this mean?
Format & documentation suggestions
Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.
[[ reason ]]
What do these messages mean?
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion
