Hi all,
I was writing a YARA-L detection rule in the Chronicle editor and I need to match the string "C:\\Program Files" with a regex. So I wrote:
re.regex($selection.src.process.file.full_path, `C:\\Program Files `)
But the editor rise this error:
parsing: invalid regex pattern: C:\\Program Files: error parsing regexp: invalid character class range: `\\Pr`
The error disappear if I escape the backslash character.
Someone knows the reason? Since I'm using back quotes shouldn't I be able to not escape the backslash as said in the reference at this link:
https://cloud.google.com/chronicle/docs/detection/yara-l-2-0-syntax#string_and_regex_literals
Page 1 / 1
However, there may be something to do with this being a special character class
\\P
is used for catching non-unicode characters
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Regular_expressions/Unicode_character_class_escape
Mhhh ok but as per documentation everything that is between back quotes should be interpreted literally.. In the link I provided thr documentation says: "Back quotes (`) — Use to interpret all characters literally.
For example: `hello\\tworld` —\\t is not interpreted as a tab"
What if I want to match that path? Already tested that if I add another backslash as escape the regex will search for "C:\\\\Program Files"
I
think
think
it still needs to be raw regex for it to work. Regex requires the backslash to be escaped. So
`C:\\\\Program...`
would be the equivalent to
C:\\\\\\\\Program...
in YARA-L
iirc, you have to escape the backslash. Here is an example.
think of regex as meaning every time there are quotes regex is on.
Just wait til your string of interest includes quotation mark chracters
Hi, I'm late in the response. Are you guys saying that the example at this link
https://cloud.google.com/chronicle/docs/detection/yara-l-2-0-syntax#string_and_regex_literals
is not valid? Because it says literally that backquotes are used to interpret all characters literally, including the backslash.
Reply
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.