Solved: Calculating days until date in Yara-L Rule - Page 2

fbaumgar · 12-25-2024 08:45 PM

I’d like to create a rule that matches if the date mentioned in an event field falls within the next 7 days. I’ve noticed various timestamp functions, but I’m not sure how to calculate the timestamp from dates other than those stored in event metadata.

Below is the regex capture of the date available in the event:

 $expiry = re.capture($e.metadata.description, ".*will expire on (\\d{4}/\\d{2}/\\d{2})")

//  $expiry = "2025/01/22"

Appreciate ideas how to calculate the time diff...

alube

There are two functions you can use to create dates via your own input.

1. https://cloud.google.com/chronicle/docs/detection/yara-l-2-0-syntax#timestampas_unix_seconds

timestamp.as_unix_seconds("2025-01-15 00:00:00","UTC")

The output of this is an integer. This allows you to use math operators to compare the event_timestamp.seconds to the converted int above.

Any date prior to the January 15th 2025 timestamp will be a lesser value.

2. https://cloud.google.com/chronicle/docs/detection/yara-l-2-0-syntax#timestampget_date

You'd have to convert your date to Unix timestamp and use that integer as the first parameter. This returns a String though so its less useful in comparison.

View solution in original post

New SecOps Webinar May 14th! Learn about Gemini's generative AI within Google SecOps

Calculating days until date in Yara-L Rule