Added domain and URL rules

b42bbf6d · Antonio S · 0d301454 · b42bbf6d · b42bbf6d
Commit b42bbf6d authored Dec 02, 2016 by Antonio S
Hide whitespace changes
Inline Side-by-side

Showing with 26 additions and 0 deletions

domain.yar utils/domain.yar +13 -0

url.yar utils/url.yar +13 -0

No files found.
--- a/utils/domain.yar
+++ b/utils/domain.yar
+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as
+    long as you use it under this license.
+*/
+
+rule domain {
+    meta:
+        author = "Antonio S. <asanchez@plutec.net>"
+    strings:
+        $domain_regex = /([\w\.-]+)/ wide ascii
+    condition:
+        $domain_regex
+}
--- a/utils/url.yar
+++ b/utils/url.yar
+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as
+    long as you use it under this license.
+*/
+
+rule url {
+    meta:
+        author = "Antonio S. <asanchez@plutec.net>"
+    strings:
+        $url_regex = /https?:\/\/([\w\.-]+)([\/\w \.-]*)/ wide ascii
+    condition:
+        $url_regex
+}