I am using plyara in a script and get the following error.
Traceback (most recent call last):
File "rule-export.py", line 19, in <module>
rulesDict = interp.parseString(open(args.f).read(), isPrintDebug=False)
File "/Library/Python/2.7/site-packages/plyara/interp.py", line 151, in parseString
parser.parse(inputString)
File "/Library/Python/2.7/site-packages/ply/yacc.py", line 331, in parse
return self.parseopt_notrack(input, lexer, debug, tracking, tokenfunc)
File "/Library/Python/2.7/site-packages/ply/yacc.py", line 1199, in parseopt_notrack
tok = call_errorfunc(self.errorfunc, errtoken, self)
File "/Library/Python/2.7/site-packages/ply/yacc.py", line 193, in call_errorfunc
r = errorfunc(token)
File "/Library/Python/2.7/site-packages/plyara/interp.py", line 574, in p_error
raise TypeError("unknown text at %r ; token of type %r" % (p.value, p.type))
TypeError: unknown text at '+' ; token of type 'PLUS'
rule koadic_enum_users {
meta:
description = "Detects Koadic component"
author = "Florian Roth"
reference = "https://github.com/zerosum0x0/koadic"
date = "2017-07-31"
hash1 = "69b03e425c37ff2526d79aed8eccf671e8e51d5b9832ae3e870718b0342890b9"
strings:
$x1 = "Koadic.work.report(\"No interactive users found.\")" fullword ascii
$x2 = "var sessions = wmi.ExecQuery(\"Select * from Win32_LogonSession Where LogonType = 2 OR LogonType = 10\");" fullword ascii
$x3 = "var wmi = GetObject(\"winmgmts:{impersonationLevel=impersonate}!\\\\\\\\\" + computer + \"\\\\root\\\\cimv2\");" fullword ascii
$x4 = "query += \"Associators of {Win32_LogonSession.LogonId=\" + session.LogonId;" fullword ascii
$s1 = "info += session.LogonType + \"\\n\";" fullword ascii
$s2 = "for (var f = new Enumerator(users); !f.atEnd(); f.moveNext())" fullword ascii
$s3 = "info += session.Description + \"\\n\";" fullword ascii
condition:
( uint16(0) == 0x7274 and filesize < 5KB and 1 of ($x*) ) or
( 2 of them )
}