Update RegEx Patterns for YARA-X Compatibility

ForensicITGuy commented 5 months ago

This PR updates regular expression strings in 3 YAR files for YARA-X compatibility. Fixing these rules also makes the YARAForge Full package compatible with YARA-X with only warnings during compilation.

ForensicITGuy commented 5 months ago

Should have mentioned, I tested out the rule changes to make sure they still work, and verified they all work with traditional YARA and YARA-X

Test files:

2e11ba2d06ebe0aa818e38e24a8a83eebbaae8877c10b704af01bf2977701e73
3eecc354390d60878afaa67a20b0802ce5805f3a9bb34e74dd8c363e3ca0ea5c
8db86ad90883cd208cf86acd45e67c03f994998804441705d690cb6526614d00
ca8d871f285784e634e0d024fe992f30c9528023c42ad2ef23d52b77124dac72

For the Exaramel Plaintext config rule I couldn't find a test case, so I made one:

{"Hosts":["randomdomain.local],"Proxy":"proxy.local","Version":"32","Guid":"stuff"}

Neo23x0 commented 5 months ago

Hi Tony, thanks a lot for the PR. Since the YARA Forge release workflow runs very early Sunday mornings. I'll delete todays release, merge this PR and re-run the workflow so that the release for the coming week is already compatible with YARA-X.

Neo23x0 / signature-base

Update RegEx Patterns for YARA-X Compatibility #321