huffyuv_grad_decorrelate_rgb__8_byt_218_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule huffyuv_grad_decorrelate_rgb__8_byt_218_ (No description metadata provided).

rule huffyuv_grad_decorrelate_rgb__8_byt_218_ {
  strings:
    $a0 = { 22 43 24 25 26 27 28 2a 4b 6c 8d ae cf d0 11 08 d2 b3 b4 b5 36 75 36 35 36 37 36 37 36 35 37 55 37 56 37 56 39 38 39 57 39 38 59 38 79 38 19 42 37 59 37 59 58 77 38 97 d6 35 37 36 b5 34 55 33 34 b3 12 0a 11 08 b0 af ae ad 6c 4b 2a 28 27 26 25 24 43 22 43 25 26 67 88 09 08 0a 0b 0b 0d 0c 0b 0d 0a 0e 0b 0f 0a 10 0d d1 92 33 32 93 f4 35 34 35 14 0a 33 34 13 08 12 09 f1 10 0c 0f 0b 0e 09 0d 0a 0c 09 0b 0d 0a 0c e9 a8 67 26 25 43 22 43 24 26 27 28 2a 4b 6c 8d ae cf b0 d1 b2 d3 94 35 34 35 76 37 76 57 58 37 39 58 37 38 39 37 58 39 38 39 58 99 38 59 38 79 38 19 4d 58 57 56 35 36 55 34 55 94 35 14 09 d3 32 73 12 09 f1 f0 6f 8e 8d 8c 4b 2a 28 27 26 63 00 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

49ffec75-6ef4-417f-95d4-d0d86e943832

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion