libavcodec_celp_math_slope_cos_G729_BITEXACT__16_big_128_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule libavcodec_celp_math_slope_cos_G729_BITEXACT__16_big_128_ (No description metadata provided).

rule libavcodec_celp_math_slope_cos_G729_BITEXACT__16_big_128_ {
  strings:
    $a0 = { FD 88 F8 9B F3 B2 EE D1 E9 FA E5 31 E0 78 DB D3 D7 44 D2 CE CE 74 CA 39 C6 1F C2 28 BE 58 BA B0 B7 33 B3 E2 B0 C1 AD D1 AB 13 A8 8A A6 36 A4 1A A2 37 A0 8D 9F 1F 9D EC 9C F6 9C 3C 9B C0 9B 82 9B 82 9B C0 9C 3C 9C F6 9D EC 9F 1F A0 8D A2 37 A4 1A A6 36 A8 8A AB 13 AD D1 B0 C1 B3 E2 B7 33 BA B0 BE 58 C2 28 C6 1F CA 39 CE 74 D2 CE D7 44 DB D3 E0 78 E5 31 E9 FA EE D1 F3 B2 F8 9B FD 88 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

aef96ff6-60c4-475e-8b0a-8412c7d54317

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion