Hi everyone.
Recently I'm writing some detection rules in YARA-L for my company.
I have a rule that simply match the following:
$selection.target.process.file.full_path = /\/bin\/bash/ and not
(
$selection.target.ip="127.0.0.1" or
$selection.target.ip="0.0.0.0"
)
This rule generates a lot of false positives every time the field target.ip is missing. I would like to trigger the rule only when that field exists and it's not equal certain values.
So.. how can I check the existence of a field in YARA-L?
Thanks