If you want to match "fish" exactly and want to only find it with spaces
around it, e.g., no periods or other characters allowed with fullword,
consider using a hex string:
$fish = { 20 66 69 73 68 20}
This would match only exactly on situations where there is a space followed
by the word "fish" and another space.
you can also consider this situation with a text string, which does
something similar, where \x20 equates to a space.
$fish2 = "\x20fish\x20"
If other situations outside of a space need to be considered, you can
address those as well in either a string or hex string.
On Tuesday, December 24, 2019 at 1:21:35 AM UTC-6, Nibin V M wrote:
>
> Hello,
>
> Is it possible to write rules for exact string match? That is, I want to
> detect string "fish" but not "fishing".
>
> Thanks in advance.
>
--
You received this message because you are subscribed to the Google Groups
"YARA" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/yara-project/27c261d7-b345-4d83-966f-06ed8d5977cd%40googlegroups.com.
