SHA256_Constants

YARA detection rule by Andrew Williams (@recvfrom) · GPL-2.0

Look for SHA256 constants

rule SHA256_Constants {
	meta:
		author = "Andrew Williams (@recvfrom)"
		description = "Look for SHA256 constants"
		date = "2020-10"
		version = "0.1"
	strings:
        $c_le_1 = { 6A09E667 }
        $c_le_2 = { BB67AE85 }
        $c_le_3 = { 3C6EF372 }
        $c_le_4 = { A54FF53A }
        $c_le_5 = { 510E527F }
        $c_le_6 = { 9B05688C }
        $c_le_7 = { 1F83D9AB }
        $c_le_8 = { 5BE0CD19 }
        $c_be_1 = { 67E6096A }
        $c_be_2 = { 85AE67BB }
        $c_be_3 = { 72F36E3C }
        $c_be_4 = { 3AF54FA5 }
        $c_be_5 = { 7F520E51 }
        $c_be_6 = { 8C68059B }
        $c_be_7 = { ABD9831F }
        $c_be_8 = { 19CDE05B }
	condition:
		5 of ($c_be_*) or 5 of ($c_le_*)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

9a7cf99c-36e1-443b-a417-582e05413b02

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion