My apologies. \b will have same problem like "fullword" keyword.
On Thu, Dec 26, 2019 at 10:51 AM raghvendra mishra < [email protected]> wrote: > Hi, > AFAIK, you have to use word boundary regex because "fullword" keyword will > have matches on strings starts or end with non-ascii char as well. So, > string "fish" will match ".fish" etc as well. You can have definition like > this, > $string1 = /\bfish\b/ > > *Cheers,* > *--Raghvendra Mishra* > *Principle Threat Researcher* > *SonicWall Inc.* > *Cell:- +91-8867404241* > > > On Wed, Dec 25, 2019 at 1:08 AM Fernando Mercês <[email protected]> wrote: > >> Hello. >> >> Check if if helps >> https://yara.readthedocs.io/en/latest/writingrules.html#searching-for-full-words >> ;-) >> >> Att, >> >> Fernando Mercês <https://twitter.com/mer0x36> | menteb.in >> >> >> On Tue, Dec 24, 2019 at 4:21 AM Nibin V M <[email protected]> wrote: >> >>> Hello, >>> >>> Is it possible to write rules for exact string match? That is, I want to >>> detect string "fish" but not "fishing". >>> >>> Thanks in advance. >>> >>> -- >>> You received this message because you are subscribed to the Google >>> Groups "YARA" group. >>> To unsubscribe from this group and stop receiving emails from it, send >>> an email to [email protected]. >>> To view this discussion on the web visit >>> https://groups.google.com/d/msgid/yara-project/98cf09f1-7453-4a7d-9729-8aa97dde8156%40googlegroups.com >>> <https://groups.google.com/d/msgid/yara-project/98cf09f1-7453-4a7d-9729-8aa97dde8156%40googlegroups.com?utm_medium=email&utm_source=footer> >>> . >>> >> -- >> You received this message because you are subscribed to the Google Groups >> "YARA" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected]. >> To view this discussion on the web visit >> https://groups.google.com/d/msgid/yara-project/CAM7p17MsmNnSmGVq5OY7M%3DZ%3DWjZNMb_vGFANn%2BXEmkUX8dX8_Q%40mail.gmail.com >> <https://groups.google.com/d/msgid/yara-project/CAM7p17MsmNnSmGVq5OY7M%3DZ%3DWjZNMb_vGFANn%2BXEmkUX8dX8_Q%40mail.gmail.com?utm_medium=email&utm_source=footer> >> . >> > -- You received this message because you are subscribed to the Google Groups "YARA" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/yara-project/CACAQ8EBXDrqOgtkXt6FAuCF-ddSbQ7bE-2Gc%3D8c8mV3z0JT0EQ%40mail.gmail.com.
