EICAR_Base64_Encoded

YARA detection rule by filescan.io

Detects base64-encoded EICAR test string, all 3 byte alignments

rule EICAR_Base64_Encoded : hardened
{
	meta:
		author = "filescan.io"
		description = "Detects base64-encoded EICAR test string, all 3 byte alignments"
		score = 75

	strings:
		$a0 = {57 44 56 50 49 56 41 6c 51 45 46 51 57 7a 52 63 55 46 70 59 4e 54 51 6f 55 46 34 70 4e 30 4e 44 4b 54 64 39 4a 45 56 4a 51 30 46 53 4c 56 4e 55 51 55 35 45 51 56 4a 45 4c 55 46 4f 56 45 6c 57 53 56 4a 56 55 79 31 55 52 56 4e 55 4c 55 5a 4a 54 45 55 68 4a 45 67 72 53 43}
		$a1 = {67 31 54 79 46 51 4a 55 42 42 55 46 73 30 58 46 42 61 57 44 55 30 4b 46 42 65 4b 54 64 44 51 79 6b 33 66 53 52 46 53 55 4e 42 55 69 31 54 56 45 46 4f 52 45 46 53 52 43 31 42 54 6c 52 4a 56 6b 6c 53 56 56 4d 74 56 45 56 54 56 43 31 47 53 55 78 46 49 53 52 49 4b 30 67 71}
		$a2 = {59 4e 55 38 68 55 43 56 41 51 56 42 62 4e 46 78 51 57 6c 67 31 4e 43 68 51 58 69 6b 33 51 30 4d 70 4e 33 30 6b 52 55 6c 44 51 56 49 74 55 31 52 42 54 6b 52 42 55 6b 51 74 51 55 35 55 53 56 5a 4a 55 6c 56 54 4c 56 52 46 55 31 51 74 52 6b 6c 4d 52 53 45 6b 53 43 74 49 4b}

	condition:
		any of them
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

3134255b-ffbd-4a22-874e-10a53668660a

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion