Is it possible to use it for non-yara scenarios

[zbalkan]

I specifically want to use this as a placement for PANHunt. I can solve the first step, the regex checks with But it also requires the Luhn algorithm check which cannot be solved with some yara rules.

[phutelmyer]

Hello @zbalkan.
YARA and MIMEtypes are used identify which scanners (like ScanCCN) to run against an observed file.
Could you provide an example of a signature or logic that is needed that is incompatible with YARA?

[zbalkan]

Hi @phutelmyer ,

For financial data, the crown jewels are the Primary Account Number (PAN) records. Just like PII, especially identity numbers, they are also in specific formats depending on the provider. For instance, the PAN of cards for the top 3 brands can be detected by these regex patterns:

Mastercard: (?:\D|^)(5[1-5][0-9]{2}(?:\ |\-|)[0-9]{4}(?:\ |\-|)[0-9]{4}(?:\ |\-|)[0-9]{4})(?:\D|$)')
Visa:       (?:\D|^)(4[0-9]{3}(?:\ |\-|)[0-9]{4}(?:\ |\-|)[0-9]{4}(?:\ |\-|)[0-9]{4})(?:\D|$)')
AMEX:       (?:\D|^)((?:34|37)[0-9]{2}(?:\ |\-|)[0-9]{6}(?:\ |\-|)[0-9]{5})(?:\D|$)

But it is not enough as there is an algorithm behind the card numbers, called Luhn. We can test it with a simple Python method:

def is_valid_luhn_checksum(pan: str) -> bool:
        """ from wikipedia: https://en.wikipedia.org/wiki/Luhn_algorithm"""

        safe_pan: str = re.sub(r'[^\d]', '', pan)

        def digits_of(n) -> list[int]:
            return [int(d) for d in str(n)]

        digits: list[int] = digits_of(safe_pan)
        odd_digits: list[int] = digits[-1::-2]
        even_digits: list[int] = digits[-2::-2]
        checksum: int = 0
        checksum += sum(odd_digits)
        for d in even_digits:
            checksum += sum(digits_of(d * 2))

        return checksum % 10 == 0

The issue is that I can solve the first step with yara using regex but not the second step. I believe it is doable but I wanted to learn what is the supported way instead of hacking my way out of this.

As you see, this is not a case for malware scanning but critical information scanning on filesystem. Therefore, if strelka does not support it or plan to support it, that's something I would like to know, so that I can try other ways.

[zbalkan]

I should have checked the code. It looks like it is already supported. Thanks.