Update base64.yar Fix #153

8da2f1be · Jaume Martin · GitHub · 52a7fc0c · 8da2f1be
Commit 8da2f1be authored 8 years ago by Jaume Martin Committed by GitHub 8 years ago
Show whitespace changes
Inline Side-by-side

Showing with 4 additions and 1 deletions

base64.yar Crypto/base64.yar +4 -1

No files found.
--- a/Crypto/base64.yar
+++ b/Crypto/base64.yar
@@ -2,8 +2,11 @@ rule contentis_base64 : Base64
 {
    meta:
        author = "Jaume Martin"
+        description = "This rule finds for base64 strings"
+        version = "0.2"
+        notes = "https://github.com/Yara-Rules/rules/issues/153"
    strings:
-        $a = /([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=)?/
+        $a = /([A-Za-z0-9+\/]{4}){3,}([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=)?/
    condition:
        $a
 }