Skip to main content
Question

parsing error when creating detection rule in SecOps

  • January 23, 2026
  • 2 replies
  • 27 views

Sam
Forum|alt.badge.img+1

Hello Commmmmunity,

I am attempting to implement the detection rule below in SecOps but keep getting an error message when I test or attempt to save the rule.

“parsing: error with token: ":" expected '=' between meta assignment key and value line: 11 column: 12-13”

rule MAL_Dropper_NetSupportRAT {

meta:

author = "Sam"

description = "Detects a dropper that delivers a decoy ChaGPT Installer and NetSupport RAT"

hash = "d86f647f3dfa6a53de7b531cb590636331f83afcea60d4b3d44de5ea3b7d33af"

malware = "NetSupport"

malware_id = "TWOU5d"

category = "MALWARE"

strings:

//dropped files

$d1 = "ChatGPT Installer.exe"

$d2 = "setup.exe"

//netsupport strings

$n1 = "NetSupport" nocase

$n2 = "install_netsupport_manager_silently"

$n3 = " [removed by moderator] "

condition:

uint16(0) == 0x5A4D and

all of ($d*) and

2 of ($n*)

}

I’m getting similar error messages for rules that have “strings:” in them. What could be wrong?

2 replies

cmorris
Staff
Forum|alt.badge.img+11
  • Staff
  • January 24, 2026

Strings is not valid, replace it with “events”. Rule documentation is here - https://docs.cloud.google.com/chronicle/docs/yara-l/yara-l-overview#rule_structure. The condition section is not valid either - https://docs.cloud.google.com/chronicle/docs/yara-l/condition-syntax


jstoner
Staff
Forum|alt.badge.img+23
  • Staff
  • January 26, 2026

To ​@cmorris point, SecOps uses YARA-L, not YARA and while there is similarity in layout, the structure is different and the underlying schema YARA-L observes is called UDM which expects specific fields to be compared to values.

 

While there are a number of functions available and re2 support for YARA-L, to write a rule in YARA-L we need an event log that is parsed to UDM in some fashion before we can start building a rule for it.

 

https://docs.cloud.google.com/chronicle/docs/yara-l/getting-started