2024-08-06 19:21:30 +03:00
|
|
|
[
|
|
|
|
{
|
|
|
|
"Pattern": "(?i)authorization:(\\s|%20)bearer(\\s|%20)(?<refine>[0-9a-z][abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890-_~.+\\/=]*)([^abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890-_~.+/=]|$)",
|
|
|
|
"Id": "SEC101/061",
|
|
|
|
"Name": "OAuth2BearerToken",
|
|
|
|
"Signatures": [
|
|
|
|
"sig=",
|
|
|
|
"ret="
|
|
|
|
],
|
|
|
|
"DetectionMetadata": "LowConfidence"
|
2024-09-12 18:03:15 +03:00
|
|
|
},
|
|
|
|
{
|
2024-09-16 17:12:14 +03:00
|
|
|
"Pattern": "(?i)[a-z0-9.=\\-:[_@\\/*\\]+?]{32}$",
|
2024-09-12 18:03:15 +03:00
|
|
|
"Id": "SEC000/003",
|
|
|
|
"Name": "Unclassified32CharacterString",
|
|
|
|
"Signatures": null,
|
|
|
|
"DetectionMetadata": "HighEntropy, Unclassified, LowConfidence"
|
|
|
|
},
|
|
|
|
{
|
2024-09-16 17:12:14 +03:00
|
|
|
"Pattern": "(^|[^abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890+/-_=])[abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890+/]{43}=",
|
2024-09-12 18:03:15 +03:00
|
|
|
"Id": "SEC000/000",
|
|
|
|
"Name": "Unclassified32ByteBase64String",
|
|
|
|
"Signatures": null,
|
|
|
|
"DetectionMetadata": "HighEntropy, Unclassified, LowConfidence"
|
|
|
|
},
|
|
|
|
{
|
2024-09-16 17:12:14 +03:00
|
|
|
"Pattern": "(^|[^abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890+/-_=])[abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890+/]{86}==",
|
2024-09-12 18:03:15 +03:00
|
|
|
"Id": "SEC000/001",
|
|
|
|
"Name": "Unclassified64ByteBase64String",
|
|
|
|
"Signatures": null,
|
|
|
|
"DetectionMetadata": "HighEntropy, Unclassified, LowConfidence"
|
|
|
|
},
|
|
|
|
{
|
|
|
|
"Pattern": "^[abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890\\-_~.]{34}$",
|
|
|
|
"Id": "SEC101/101",
|
|
|
|
"Name": "AadClientAppLegacyCredentials",
|
|
|
|
"Signatures": null,
|
|
|
|
"DetectionMetadata": "ObsoleteFormat, HighEntropy, LowConfidence"
|
|
|
|
},
|
|
|
|
{
|
2024-09-16 17:12:14 +03:00
|
|
|
"Pattern": "(^|[^1234567890abcdef])[1234567890abcdef]{32}([^1234567890abcdef]|$)",
|
2024-09-12 18:03:15 +03:00
|
|
|
"Id": "SEC000/002",
|
|
|
|
"Name": "Unclassified16ByteHexadecimalString",
|
|
|
|
"Signatures": null,
|
|
|
|
"DetectionMetadata": "HighEntropy, Unclassified, LowConfidence"
|
2024-08-06 19:21:30 +03:00
|
|
|
}
|
|
|
|
]
|