CRC_5_USB_poly_0x14__8_byt_refl_True_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC_5_USB_poly_0x14__8_byt_refl_True_ (No description metadata provided).

rule CRC_5_USB_poly_0x14__8_byt_refl_True_ {
  strings:
    $a0 = { 00 11 22 33 15 04 37 26 2a 3b 08 19 3f 2e 1d 0c 05 14 27 36 10 01 32 23 2f 3e 0d 1c 3a 2b 18 09 0a 1b 28 39 1f 0e 3d 2c 20 31 02 13 35 24 17 06 0f 1e 2d 3c 1a 0b 38 29 25 34 07 16 30 21 12 03 14 05 36 27 01 10 23 32 3e 2f 1c 0d 2b 3a 09 18 11 00 33 22 04 15 26 37 3b 2a 19 08 2e 3f 0c 1d 1e 0f 3c 2d 0b 1a 29 38 34 25 16 07 21 30 03 12 1b 0a 39 28 0e 1f 2c 3d 31 20 13 02 24 35 06 17 28 39 0a 1b 3d 2c 1f 0e 02 13 20 31 17 06 35 24 2d 3c 0f 1e 38 29 1a 0b 07 16 25 34 12 03 30 21 22 33 00 11 37 26 15 04 08 19 2a 3b 1d 0c 3f 2e 27 36 05 14 32 23 10 01 0d 1c 2f 3e 18 09 3a 2b 3c 2d 1e 0f 29 38 0b 1a 16 07 34 25 03 12 21 30 39 28 1b 0a 2c 3d 0e 1f 13 02 31 20 06 17 24 35 36 27 14 05 23 32 01 10 1c 0d 3e 2f 09 18 2b 3a 33 22 11 00 26 37 04 15 19 08 3b 2a 0c 1d 2e 3f }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

f77e4568-baf1-4f77-bc33-5fb1eda496a4

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion