huffyuv_left_yuv__8_byt_152_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule huffyuv_left_yuv__8_byt_152_ (No description metadata provided).

rule huffyuv_left_yuv__8_byt_152_ {
  strings:
    $a0 = { 42 24 25 26 47 88 e9 0a 0c 0b 12 0c 15 0d 15 0e 11 0f 0d d0 11 08 10 08 0f 0d 2e 2f 0e 0c 0d 11 0c 16 0b 11 0a 0c e9 c8 47 26 25 24 23 42 24 25 26 27 28 29 2a 4b 2c 4d 4e 4f 50 51 72 53 34 95 56 57 b9 3a 59 1a 9e 39 7a 39 5a 39 57 36 37 96 35 36 95 74 73 72 51 70 af 4e 2d 2c 2b 4a 28 27 26 25 24 22 42 24 25 47 28 49 4a 4b 4c 4d 4e 4f 50 71 b2 31 b0 51 52 34 35 37 1a ae 79 5a 38 39 38 77 56 35 34 33 34 33 31 30 2f 2e 4d 4c 4b 4a 49 28 27 26 25 24 22 00 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

8df21d14-2ea6-4017-847d-8686e4433931

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion