Hi, AFAIK, you have to use word boundary regex because "fullword" keyword will have matches on strings starts or end with non-ascii char as well. So, string "fish" will match ".fish" etc as well. You can have definition like this, $string1 = /\bfish\b/
*Cheers,* *--Raghvendra Mishra* *Principle Threat Researcher* *SonicWall Inc.* *Cell:- +91-8867404241* On Wed, Dec 25, 2019 at 1:08 AM Fernando Mercês <[email protected]> wrote: > Hello. > > Check if if helps > https://yara.readthedocs.io/en/latest/writingrules.html#searching-for-full-words > ;-) > > Att, > > Fernando Mercês <https://twitter.com/mer0x36> | menteb.in > > > On Tue, Dec 24, 2019 at 4:21 AM Nibin V M <[email protected]> wrote: > >> Hello, >> >> Is it possible to write rules for exact string match? That is, I want to >> detect string "fish" but not "fishing". >> >> Thanks in advance. >> >> -- >> You received this message because you are subscribed to the Google Groups >> "YARA" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected]. >> To view this discussion on the web visit >> https://groups.google.com/d/msgid/yara-project/98cf09f1-7453-4a7d-9729-8aa97dde8156%40googlegroups.com >> <https://groups.google.com/d/msgid/yara-project/98cf09f1-7453-4a7d-9729-8aa97dde8156%40googlegroups.com?utm_medium=email&utm_source=footer> >> . >> > -- > You received this message because you are subscribed to the Google Groups > "YARA" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To view this discussion on the web visit > https://groups.google.com/d/msgid/yara-project/CAM7p17MsmNnSmGVq5OY7M%3DZ%3DWjZNMb_vGFANn%2BXEmkUX8dX8_Q%40mail.gmail.com > <https://groups.google.com/d/msgid/yara-project/CAM7p17MsmNnSmGVq5OY7M%3DZ%3DWjZNMb_vGFANn%2BXEmkUX8dX8_Q%40mail.gmail.com?utm_medium=email&utm_source=footer> > . > -- You received this message because you are subscribed to the Google Groups "YARA" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/yara-project/CACAQ8ECjfYxAF872Fw1nOZ01uwNNU7mqn4AwoSHyOTB9nGEmmg%40mail.gmail.com.
