1- name: SECRET_PAIR
2 severity: medium
3 confidence: moderate
4 type: pattern
5 values:
6 - (?P<variable>[`'\"]?(?i:token|secret|key|키|암호|암호화|토큰)[`'\"]?)((\s)*[=:](\s)*)(?P<quote>[`'\"(])?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){8,80}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)[)`'\"])
7 filter_type:
8 - ValueAllowlistCheck
9 - ValuePatternCheck
10 - ValueEntropyBase64Check
11 - ValueCoupleKeywordCheck
12 min_line_len: 16
13 required_substrings:
14 - token
15 - secret
16 - key
17 - 키
18 - 암호
19 - 암호화
20 - 토큰
21 target:
22 - doc
23
24- name: PASSWD_PAIR
25 severity: medium
26 confidence: moderate
27 type: pattern
28 values:
29 - (?P<variable>[`'\"]?(?i:(?<!id[ :/])pa[as]swo?r?ds?|pwd?|p/w|비밀번호|비번|패스워드|암호)[`'\"]?)((\s)*[=:](\s)*)(?P<quote>[`'\"(])?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){8,31}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)[)`'\"])
30 filter_type:
31 - ValueAllowlistCheck
32 - ValuePatternCheck
33 - ValueDictionaryKeywordCheck
34 - LineGitBinaryCheck
35 - LineUUEPartCheck
36 - ValueFilePathCheck
37 - ValueHexNumberCheck
38 min_line_len: 10
39 required_substrings:
40 - pass
41 - sword
42 - pw
43 - p/w
44 - paasw
45 - 비밀번호
46 - 비번
47 - 패스워드
48 - 암호
49 target:
50 - doc
51
52- name: IP_ID_PASSWORD_TRIPLE
53 severity: medium
54 confidence: moderate
55 type: pattern
56 values:
57 - (^|\s|(?P<variable>(?i:\bip[\s/]{1,80}id[\s/]{1,80}pw[\s/:]{0,80}))|(?P<url>://))(?P<ip>[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2})((\s*\()?|(?(variable)[\s,/]{1,80}|(?(url)[,]|[,/])))\s*\w[\w.-]{3,80}[\s,/]{1,80}(?P<value>(?(url)(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9_+=~!@#$%^&*;?-])){7,31}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x)|(?-i:(?P<e>[A-Z])|(?P<f>[a-z])|(?P<g>[0-9/_+=~!@#$%^&*;?-])){7,31}(?(e)(?(f)(?(g)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x)))(?:\s|[^/]|$)
58 filter_type:
59 - ValueAllowlistCheck
60 - ValuePatternCheck
61 - ValueDictionaryKeywordCheck
62 min_line_len: 10
63 required_substrings:
64 - "."
65 target:
66 - doc
67
68- name: ID_PAIR_PASSWD_PAIR
69 severity: medium
70 confidence: moderate
71 type: pattern
72 values:
73 - (?P<ddash>--)?(?P<variable>\w*(?i:pa[as]swords?|passwd?|pwd|\bp/w|\bpw|비밀번호|비번|패스워드|암호))\s*?(?(ddash)[ =]|[:=/>-]{1,2})\s*(?P<quote>[`'\"]{1,8})?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){4,31}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)(?P=quote)|(\s|$))
74 - (?P<ddash>--)?(?P<variable>(?i:user\s*)?(?i:id|login|account|root|admin|user|name|wifi|role|host|default|계정|아이디))\s*?(?(ddash)[ =]|[ :=])\s*?(?P<value>\S+)
75 filter_type:
76 - ValueAllowlistCheck
77 - ValuePatternCheck
78 min_line_len: 10
79 required_substrings:
80 - pass
81 - sword
82 - p/w
83 - pw
84 - 비밀번호
85 - 비번
86 - 패스워드
87 - 암호
88 target:
89 - doc
90
91- name: ID_PASSWD_PAIR
92 severity: medium
93 confidence: moderate
94 type: pattern
95 values:
96 - (?P<variable>[\w.-]{0,80}(?i:(?P<id>\bid\b)|id\b|user|name|계정|아이디)[\w.-]{0,80}(?(id)[ :(/]{1,80}|[:(/]{1,80})(?i:pa[as]swo?r?ds?|pwd?|비밀번호|비번|패스워드|암호))\)?(\s*->\s*|[ =:)(/]{1,80}|\s+is\s+|\s+are\s+|\s*는\s*|\s*은\s*|\s*설정은\s*)\(?(?P<id_value>[\w.-]{2,31})[ :\(/\"',]{1,80}(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){4,31}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))
97 filter_type:
98 - ValueAllowlistCheck
99 - ValuePatternCheck
100 - ValueDictionaryKeywordCheck
101 min_line_len: 10
102 required_substrings:
103 - pw
104 - pass
105 - sword
106 - 비밀번호
107 - 비번
108 - 패스워드
109 - 암호
110 target:
111 - doc
112
113- name: API
114 severity: medium
115 confidence: moderate
116 type: keyword
117 values:
118 - api(?!tal)
119 filter_type: GeneralKeyword
120 use_ml: true
121 min_line_len: 11
122 required_substrings:
123 - api
124 target:
125 - code
126
127- name: UUID
128 severity: info
129 confidence: strong
130 type: pattern
131 values:
132 - (?<![0-9A-Za-z_-])(?P<value>[0-9A-Fa-f]{8}(-[0-9A-Fa-f]{4}){3}-[0-9A-Fa-f]{12})(?![0-9A-Za-z_-])
133 min_line_len: 36
134 required_substrings:
135 - "-"
136 required_regex: "[0-9A-Za-z_/+-]{15}"
137 filter_type:
138 - ValuePatternCheck
139 use_ml: false
140 target:
141 - code
142 - doc
143
144- name: AWS Client ID
145 severity: high
146 confidence: moderate
147 type: pattern
148 values:
149 - (?<![0-9A-Za-z_-])(?P<value>(ABIA|ACCA|AGPA|AIDA|AIPA|AKIA|ANPA|ANVA|AROA|APKA|ASCA|ASIA)[0-9A-Z]{16,17})(?![0-9A-Za-z_-])
150 filter_type: GeneralPattern
151 required_substrings:
152 - A
153 min_line_len: 20
154 required_regex: "[0-9A-Za-z_/+-]{15}"
155 target:
156 - code
157 - doc
158
159- name: AWS Multi
160 severity: high
161 confidence: moderate
162 type: multi
163 values:
164 - (?<![0-9A-Za-z_-])(?P<value>(ABIA|ACCA|AGPA|AIDA|AIPA|AKIA|ANPA|ANVA|AROA|APKA|ASCA|ASIA)[0-9A-Z]{16,17})(?![0-9A-Za-z_-])
165 - (?<![0-9A-Za-z_/+-])(?P<value>[0-9A-Za-z/+]{35,80})(?![0-9A-Za-z_/+-])
166 filter_type: GeneralPattern
167 required_substrings:
168 - A
169 min_line_len: 20
170 required_regex: "[0-9A-Za-z_/+-]{15}"
171 target:
172 - code
173 - doc
174
175- name: AWS MWS Key
176 severity: high
177 confidence: strong
178 type: pattern
179 values:
180 - (?<![0-9A-Za-z_-])(?P<value>amzn\.mws\.[0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12})(?![0-9A-Za-z_-])
181 filter_type: GeneralPattern
182 required_substrings:
183 - amzn
184 min_line_len: 30
185 target:
186 - code
187 - doc
188
189- name: Credential
190 severity: medium
191 confidence: moderate
192 type: keyword
193 values:
194 - credential
195 filter_type: GeneralKeyword
196 use_ml: true
197 min_line_len: 18
198 required_substrings:
199 - credential
200 target:
201 - code
202
203- name: Dynatrace API Token
204 severity: high
205 confidence: moderate
206 type: pattern
207 values:
208 - (?<![0-9A-Za-z_-])(?P<value>dt0[A-Za-z]{1}[0-9]{2}\.[0-9A-Z]{24}\.[0-9A-Z]{64})(?![0-9A-Za-z_-])
209 filter_type: GeneralPattern
210 required_substrings:
211 - dt0
212 min_line_len: 90
213 target:
214 - code
215 - doc
216
217- name: Facebook Access Token
218 severity: high
219 confidence: moderate
220 type: pattern
221 values:
222 - (?<![0-9A-Za-z_-])(?P<value>EAA[0-9A-Za-z]{80,800})
223 filter_type:
224 - ValuePatternCheck
225 - ValueBase64PartCheck
226 required_substrings:
227 - EAA
228 min_line_len: 80
229 target:
230 - code
231 - doc
232
233- name: Facebook App Token
234 severity: high
235 confidence: moderate
236 type: pattern
237 values:
238 - (?<![0-9A-Za-z_-])(?P<value>[0-9]{12,18}\|[0-9A-Za-z_-]{24,28})(?![0-9A-Za-z_-])
239 filter_type: GeneralPattern
240 required_substrings:
241 - "|"
242 required_regex: "[0-9A-Za-z_/+-]{15}"
243 min_line_len: 33
244 target:
245 - code
246 - doc
247
248- name: Github Old Token
249 severity: high
250 confidence: moderate
251 type: pattern
252 values:
253 - (?i)((git)[0-9A-Za-z_-]{0,80}(token|key|api)[0-9A-Za-z_-]{0,80}(\s)*(=|:|:=)(\s)*(["']?)(?P<value>[0-9a-z]{40})(["']?))
254 filter_type: GeneralPattern
255 use_ml: true
256 validations:
257 - GithubTokenValidation
258 required_substrings:
259 - git
260 min_line_len: 47
261 target:
262 - code
263 - doc
264
265- name: Google API Key
266 severity: high
267 confidence: moderate
268 type: pattern
269 values:
270 - (?<![0-9A-Za-z_-])(?P<value>AIza[0-9A-Za-z_-]{35})(?![0-9A-Za-z_-])
271 filter_type: GeneralPattern
272 validations:
273 - GoogleApiKeyValidation
274 required_substrings:
275 - AIza
276 min_line_len: 39
277 target:
278 - code
279 - doc
280
281- name: Google Multi
282 severity: high
283 confidence: moderate
284 type: multi
285 values:
286 - (?P<value>[0-9]{3,80}-[0-9a-z_]{32}\.apps\.googleusercontent\.com)
287 - \b(?P<value>GOCSPX-[0-9A-Za-z_-]{28}|((?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9_-])){24,80}(?(a)(?(b)(?(c)\b|(?!x)x)|(?!x)x)|(?!x)x))
288 filter_type: GeneralPattern
289 validations:
290 - GoogleMultiValidation
291 required_substrings:
292 - .apps.googleusercontent.com
293 min_line_len: 40
294 target:
295 - code
296 - doc
297
298- name: Google OAuth Secret
299 severity: high
300 confidence: strong
301 type: pattern
302 values:
303 - (?<![0-9A-Za-z_-])(?P<value>GOCSPX-[0-9A-Za-z_-]{28})(?![0-9A-Za-z_-])
304 filter_type: GeneralPattern
305 required_substrings:
306 - GOCSPX-
307 min_line_len: 40
308 target:
309 - code
310 - doc
311
312- name: Google OAuth Access Token
313 severity: high
314 confidence: moderate
315 type: pattern
316 values:
317 - (?<![0-9A-Za-z_-])(?P<value>ya29\.[0-9A-Za-z_-]{22,8000})
318 filter_type: GeneralPattern
319 required_substrings:
320 - ya29.
321 min_line_len: 27
322 target:
323 - code
324 - doc
325
326- name: Heroku API Key
327 severity: high
328 confidence: moderate
329 type: pattern
330 values:
331 - (?i)(?P<value>heroku(.{0,20})?[0-9a-f]{8}(-[0-9a-f]{4})+-[0-9a-f]{12})(?![0-9A-Za-z_-])
332 filter_type: GeneralPattern
333 required_substrings:
334 - heroku
335 min_line_len: 24
336 target:
337 - code
338 - doc
339
340- name: Instagram Access Token
341 severity: high
342 confidence: strong
343 type: pattern
344 values:
345 - (?<![0-9A-Za-z_-])(?P<value>IGQVJ[0-9A-Za-z_=-]{100,8000})
346 filter_type: GeneralPattern
347 required_substrings:
348 - IGQVJ
349 min_line_len: 105
350 target:
351 - code
352 - doc
353
354- name: JSON Web Token
355 severity: medium
356 confidence: strong
357 type: pattern
358 values:
359 - (?<![0-9A-Za-z_-])(?P<value>eyJ[0-9A-Za-z_+/=-]{15,8000}(\.[0-9A-Za-z_+/=-]{0,8000}){2,16})
360 filter_type:
361 - ValueJsonWebTokenCheck
362 required_substrings:
363 - eyJ
364 min_line_len: 18
365 target:
366 - code
367 - doc
368
369- name: MailChimp API Key
370 severity: high
371 confidence: moderate
372 type: pattern
373 values:
374 - (?<![0-9A-Za-z_-])(?P<value>[0-9A-Za-z_-]{32}-us[0-9]{1,2})(?![0-9A-Za-z_-])
375 filter_type: GeneralPattern
376 validations:
377 - MailChimpKeyValidation
378 required_substrings:
379 - -us
380 min_line_len: 35
381 target:
382 - code
383 - doc
384
385- name: MailGun API Key
386 severity: high
387 confidence: moderate
388 type: pattern
389 values:
390 - (?<![0-9A-Za-z_-])(?P<value>key-[0-9A-Za-z_-]{32})(?![0-9A-Za-z_-])
391 filter_type: GeneralPattern
392 required_substrings:
393 - key-
394 min_line_len: 36
395 target:
396 - code
397 - doc
398
399- name: Password
400 severity: medium
401 confidence: moderate
402 type: keyword
403 values:
404 - (?<!by)pass(?!ed|ing|es|\s+[a-z]{3,80})|pw(d|\b)
405 filter_type: PasswordKeyword
406 use_ml: true
407 min_line_len: 10
408 required_substrings:
409 - pass
410 - pw
411 target:
412 - code
413
414- name: PayPal Braintree Access Token
415 severity: high
416 confidence: strong
417 type: pattern
418 values:
419 - (?P<value>access_token\$production\$[0-9a-z]{16}\$[0-9a-z]{32})(?![0-9A-Za-z_-])
420 filter_type: GeneralPattern
421 required_substrings:
422 - access_token$production$
423 min_line_len: 72
424 target:
425 - code
426 - doc
427
428- name: PEM Private Key
429 severity: high
430 confidence: strong
431 type: pem_key
432 values:
433 - (?P<value>-----BEGIN\s(?!ENCRYPTED)[^-]{0,80}PRIVATE[^-]{0,80}KEY[^-]{0,40}-----(.+-----END[^-]{1,80}KEY[^-]{0,40}-----)?)
434 min_line_len: 27
435 target:
436 - code
437 - doc
438
439- name: BASE64 encoded PEM Private Key
440 severity: high
441 confidence: strong
442 type: pattern
443 values:
444 - (?P<value>[0-9A-Za-z_/+-]{0,8000}LS0t(LS1CRUdJTiB|LUJFR0lOI|QkVHSU4g)[0-9A-Za-z_/+-]{0,11}(UFJJVkFURSBLRVkt|QUklWQVRFIEtFWS0t|FBSSVZBVEUgS0VZ)[0-9A-Za-z_/+-]{1,8000}LS0t[0-9A-Za-z_/+-]{1,8000})
445 filter_type:
446 - ValueBase64EncodedPem
447 min_line_len: 300
448 required_substrings:
449 - UFJJVkFURSBLRVkt
450 - QUklWQVRFIEtFWS0t
451 - FBSSVZBVEUgS0VZ
452 target:
453 - code
454 - doc
455
456- name: BASE64 Private Key
457 severity: high
458 confidence: strong
459 type: pattern
460 values:
461 - (?P<value>\bMII[A-Za-f][0-9A-Za-z/+]{8}(?s:[^!#$&()*\-.:;<=>?@\[\]^_{|}~]{8,8000}))
462 filter_type:
463 - ValueBase64KeyCheck
464 min_line_len: 160
465 required_substrings:
466 - MII
467 target:
468 - code
469 - doc
470
471- name: Picatic API Key
472 severity: high
473 confidence: strong
474 type: pattern
475 values:
476 - (?P<value>sk_live_[0-9a-z]{32})(?![0-9A-Za-z_-])
477 filter_type: GeneralPattern
478 required_substrings:
479 - sk_live_
480 min_line_len: 40
481 target:
482 - code
483 - doc
484
485- name: Secret
486 severity: medium
487 confidence: moderate
488 type: keyword
489 values:
490 - secret
491 filter_type: GeneralKeyword
492 use_ml: true
493 min_line_len: 14
494 required_substrings:
495 - secret
496 target:
497 - code
498
499- name: SendGrid API Key
500 severity: high
501 confidence: moderate
502 type: pattern
503 values:
504 - (?P<value>SG\.[0-9A-Za-z_-]{16,32}\.[0-9A-Za-z_-]{16,64})
505 filter_type: GeneralPattern
506 required_substrings:
507 - SG.
508 min_line_len: 34
509 target:
510 - code
511 - doc
512
513- name: Shopify Token
514 severity: high
515 confidence: strong
516 type: pattern
517 values:
518 - (?P<value>shp(at|ca|pa|ss)_[0-9A-Fa-f]{32})(?![0-9A-Za-z_-])
519 filter_type: TokenPattern
520 required_substrings:
521 - shp
522 min_line_len: 38
523 target:
524 - code
525 - doc
526
527- name: Slack Token
528 severity: high
529 confidence: strong
530 type: pattern
531 values:
532 - (?<![0-9A-Za-z_-])(?P<value>xox[aboprst]\-[0-9A-Za-z-]{10,250})
533 filter_type: GeneralPattern
534 validations:
535 - SlackTokenValidation
536 required_substrings:
537 - xox
538 min_line_len: 15
539 target:
540 - code
541 - doc
542
543- name: Slack Webhook
544 severity: high
545 confidence: strong
546 type: pattern
547 values:
548 - (?P<value>hooks\.slack\.com/services/T[0-9A-Z]{8,16}/B[0-9A-Z]{8,16}/\w{24})
549 filter_type: GeneralPattern
550 required_substrings:
551 - hooks.slack.com/services/T
552 min_line_len: 61
553 target:
554 - code
555 - doc
556
557- name: Stripe Standard API Key
558 severity: high
559 confidence: strong
560 type: pattern
561 values:
562 - (?P<value>sk_live_[0-9A-Za-z_-]{24})(?![0-9A-Za-z_-])
563 filter_type: GeneralPattern
564 validations:
565 - StripeApiKeyValidation
566 required_substrings:
567 - sk_live_
568 min_line_len: 32
569 target:
570 - code
571 - doc
572
573- name: Stripe Restricted API Key
574 severity: high
575 confidence: strong
576 type: pattern
577 values:
578 - (?P<value>rk_live_[0-9A-Za-z_-]{24})(?![0-9A-Za-z_-])
579 filter_type: GeneralPattern
580 required_substrings:
581 - rk_live_
582 min_line_len: 32
583 target:
584 - code
585 - doc
586
587- name: Square Access Token
588 severity: high
589 confidence: moderate
590 type: pattern
591 values:
592 - (?<![0-9A-Za-z_-])(?P<value>EAAA[0-9A-Za-z_-]{60})(?![0-9A-Za-z_-])
593 filter_type: GeneralPattern
594 validations:
595 - SquareAccessTokenValidation
596 required_substrings:
597 - EAAA
598 min_line_len: 64
599 target:
600 - code
601 - doc
602
603- name: Square Client ID
604 severity: medium
605 confidence: strong
606 type: pattern
607 values:
608 - (?<![0-9A-Za-z_-])(?P<value>sq0[a-z]{3}-[0-9A-Za-z_-]{22})(?![0-9A-Za-z_-])
609 filter_type: GeneralPattern
610 validations:
611 - SquareClientIdValidation
612 required_substrings:
613 - sq0
614 min_line_len: 29
615 target:
616 - code
617 - doc
618
619- name: Square OAuth Secret
620 severity: high
621 confidence: strong
622 type: pattern
623 values:
624 - (?P<value>sq0csp-[0-9A-Za-z_-]{43})(?![0-9A-Za-z_-])
625 filter_type: GeneralPattern
626 required_substrings:
627 - sq0csp
628 min_line_len: 50
629 target:
630 - code
631 - doc
632
633- name: Token
634 severity: medium
635 confidence: moderate
636 type: keyword
637 values:
638 - token(?!ize)
639 filter_type: GeneralKeyword
640 use_ml: true
641 min_line_len: 13
642 required_substrings:
643 - token
644 target:
645 - code
646
647- name: Twilio API Key
648 severity: high
649 confidence: moderate
650 type: pattern
651 values:
652 - (?<![0-9A-Za-z_-])(?P<value>SK[0-9A-Fa-f]{32})(?![0-9A-Za-z_-])
653 filter_type: GeneralPattern
654 required_substrings:
655 - SK
656 min_line_len: 34
657 target:
658 - code
659 - doc
660
661- name: CMD ConvertTo-SecureString
662 severity: high
663 confidence: moderate
664 type: pattern
665 values:
666 - (^|\W|\\[tnr])(?P<variable>ConvertTo-SecureString(\s\s*-(String|AsPlainText|Force))*)\s\s*(?P<value_leftquote>(\\?[\"']){1,3})?(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,800})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
667 filter_type: GeneralKeyword
668 use_ml: true
669 required_substrings:
670 - convertto-securestring
671 min_line_len: 27
672 target:
673 - code
674
675- name: CMD Password
676 severity: high
677 confidence: moderate
678 type: pattern
679 values:
680 - (^|\W|\\[tnr])(?P<variable>-[A-Za-z_-]*(?i:pass(in|out|word|phrase)))\s\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(pass:)?(?!file:|env:|fd:)(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,80})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
681 filter_type: GeneralKeyword
682 use_ml: true
683 required_substrings:
684 - pass
685 min_line_len: 12
686 target:
687 - code
688
689- name: CMD Token
690 severity: high
691 confidence: moderate
692 type: pattern
693 values:
694 - (^|\W|\\[tnr])(?P<variable>-[A-Za-z_-]*(?i:token))\s\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,4000})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
695 filter_type: GeneralKeyword
696 use_ml: true
697 required_substrings:
698 - token
699 min_line_len: 12
700 target:
701 - code
702
703- name: CMD Secret
704 severity: high
705 confidence: moderate
706 type: pattern
707 values:
708 - (^|\W|\\[tnr])(?P<variable>-[A-Za-z_-]*(?i:secret)[A-Za-z_-]*)\s\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(pass:)?(?!file:|env:|fd:)(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,4000})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
709 filter_type: GeneralKeyword
710 use_ml: true
711 required_substrings:
712 - secret
713 min_line_len: 12
714 target:
715 - code
716
717- name: URL Credentials
718 severity: high
719 confidence: moderate
720 type: pattern
721 values:
722 - (?P<value_leftquote>[\"'])?(?P<variable>[+0-9A-Za-z-]{2,80}://)([^\s\'"<>\[\]^~`{|}:/]{0,80}:){1,3}(?P<value>[^\s\'"<>\[\]^~`{|}@:/]{3,80})@[^\s\'"<>\[\]^~`{|}@:/]{1,800}\\{0,8}(?P<value_rightquote>[\"'])?
723 filter_type: UrlCredentialsGroup
724 use_ml: true
725 required_substrings:
726 - ://
727 min_line_len: 10
728 target:
729 - code
730
731- name: Auth
732 severity: medium
733 confidence: moderate
734 type: keyword
735 values:
736 - auth(?!ors?(?!i[tz]))
737 filter_type: GeneralKeyword
738 use_ml: true
739 min_line_len: 12
740 required_substrings:
741 - auth
742 target:
743 - code
744
745- name: Key
746 severity: medium
747 confidence: moderate
748 type: keyword
749 values:
750 - key(?!word|board|pad|name)
751 filter_type: GeneralKeyword
752 use_ml: true
753 min_line_len: 11
754 required_substrings:
755 - key
756 target:
757 - code
758
759- name: Telegram Bot API Token
760 severity: high
761 confidence: moderate
762 type: pattern
763 values:
764 - (?P<value>[0-9]{8,10}:[0-9A-Za-z_-]{35})(?![0-9A-Za-z_-])
765 filter_type: GeneralPattern
766 required_substrings:
767 - :AA
768 min_line_len: 45
769 target:
770 - code
771 - doc
772
773- name: PyPi API Token
774 severity: high
775 confidence: strong
776 type: pattern
777 values:
778 - (?P<value>pypi-[0-9A-Za-z_-]{150,8000})
779 filter_type: GeneralPattern
780 required_substrings:
781 - pypi-
782 min_line_len: 155
783 target:
784 - code
785 - doc
786
787- name: Github Classic Token
788 severity: high
789 confidence: strong
790 type: pattern
791 values:
792 - (?<![0-9A-Za-z_-])(?P<value>gh[pousr]_[0-9A-Za-z_-]{36,255})
793 filter_type:
794 - ValueGitHubCheck
795 validations:
796 - GithubTokenValidation
797 required_substrings:
798 - ghp_
799 - gho_
800 - ghu_
801 - ghs_
802 - ghr_
803 min_line_len: 40
804 target:
805 - code
806 - doc
807
808- name: Github Fine-granted Token
809 severity: high
810 confidence: strong
811 type: pattern
812 values:
813 - (?<![0-9A-Za-z_-])(?P<value>github_pat_[0-9A-Za-z_]{80,255})
814 filter_type: GeneralPattern
815 validations:
816 - GithubTokenValidation
817 required_substrings:
818 - github_pat_
819 min_line_len: 90
820 target:
821 - code
822 - doc
823
824- name: Firebase Domain
825 severity: info
826 confidence: moderate
827 type: pattern
828 values:
829 - (?<![0-9A-Za-z_])(?P<value>[a-z0-9.-]{1,80}\.firebaseio\.com|[a-z0-9.-]{1,80}\.firebaseapp\.com)
830 filter_type: GeneralPattern
831 required_substrings:
832 - .firebase
833 min_line_len: 16
834 target:
835 - code
836 - doc
837
838- name: AWS S3 Bucket
839 severity: info
840 confidence: moderate
841 type: pattern
842 values:
843 - (?<![0-9A-Za-z_])(?P<value>[a-z0-9.-]{3,63}\.s3\.amazonaws\.com|[a-z0-9.-]{3,63}\.s3-website[.-](eu|ap|us|ca|sa|cn))
844 filter_type: GeneralPattern
845 required_substrings:
846 - .s3-website
847 - .s3.amazonaws.com
848 min_line_len: 14
849 target:
850 - code
851 - doc
852
853- name: Nonce
854 severity: medium
855 confidence: moderate
856 type: keyword
857 values:
858 - nonce
859 filter_type: GeneralKeyword
860 use_ml: true
861 min_line_len: 13
862 required_substrings:
863 - nonce
864 target:
865 - code
866
867- name: Salt
868 severity: medium
869 confidence: moderate
870 type: keyword
871 values:
872 - salt
873 filter_type: GeneralKeyword
874 use_ml: true
875 min_line_len: 12
876 required_substrings:
877 - salt
878 target:
879 - code
880
881- name: Certificate
882 severity: medium
883 confidence: moderate
884 type: keyword
885 values:
886 - cert
887 filter_type: GeneralKeyword
888 use_ml: true
889 min_line_len: 12
890 required_substrings:
891 - cert
892 target:
893 - code
894
895- name: Jfrog Token
896 severity: high
897 confidence: strong
898 type: pattern
899 values:
900 - (?<![0-9A-Za-z_-])(?P<value>(cmVmdGtuO[0-9A-Za-z_-]{55}|AKCp[0-9A-Za-z_-]{69}))(?![0-9A-Za-z_-])
901 filter_type:
902 - ValueJfrogTokenCheck
903 required_substrings:
904 - cmVmdGtuO
905 - AKCp
906 min_line_len: 64
907 target:
908 - code
909 - doc
910
911- name: Azure Access Token
912 severity: high
913 confidence: strong
914 type: pattern
915 values:
916 - (?<![0-9A-Za-z_-])(?P<value>eyJ[0-9A-Za-z_=-]{50,500}\.eyJ[0-9A-Za-z_=-]{8,8000}\.[0-9A-Za-z_=-]{18,800})
917 filter_type:
918 - ValueAzureTokenCheck
919 required_substrings:
920 - eyJ
921 min_line_len: 148
922 target:
923 - code
924 - doc
925
926- name: Azure Secret Value
927 severity: high
928 confidence: moderate
929 type: pattern
930 values:
931 - (?<![0-9A-Za-z_-])(?P<value>[0-9A-Za-z_~.-]{3}8Q~[0-9A-Za-z_~.-]{34})(?![0-9A-Za-z_-])
932 filter_type: TokenPattern
933 min_line_len: 40
934 required_substrings:
935 - 8Q~
936 target:
937 - code
938 - doc
939
940- name: Bitbucket App Password
941 severity: high
942 confidence: strong
943 type: pattern
944 values:
945 - (?<![0-9A-Za-z_-])(?P<value>ATBB[0-9A-Za-z]{24}[A-F0-9]{8})(?![0-9A-Za-z_-])
946 filter_type:
947 - ValueAtlassianTokenCheck
948 min_line_len: 28
949 required_substrings:
950 - ATBB
951 target:
952 - code
953 - doc
954
955- name: Bitbucket Repository Access Token
956 severity: high
957 confidence: strong
958 type: pattern
959 values:
960 - (?<![0-9A-Za-z_-])(?P<value>ATCTT3xFfGN0[0-9A-Za-z_-]{80,800}(\\?=|%3[dD])[A-F0-9]{8})(?![0-9A-Za-z_-])
961 filter_type:
962 - ValueAtlassianTokenCheck
963 min_line_len: 160
964 required_substrings:
965 - ATCTT3xFfGN0
966 target:
967 - code
968 - doc
969
970- name: Bitbucket HTTP Access Token
971 severity: high
972 confidence: strong
973 type: pattern
974 values:
975 - (?<![0-9A-Za-z_-])(?P<value>BBDC-[NMO][ADgjQTwz][0-9A-Za-z_-]{42})(?![0-9A-Za-z_-])
976 filter_type:
977 - ValueAtlassianTokenCheck
978 min_line_len: 49
979 required_substrings:
980 - BBDC-
981 target:
982 - code
983 - doc
984
985- name: Bitbucket Client ID
986 severity: info
987 confidence: weak
988 type: pattern
989 values:
990 - (?<![.0-9A-Za-z_/+-])(?P<value>[0-9A-Za-z]{18}([0-9A-Za-z]{14})?)(?![0-9A-Za-z.$_/+-])
991 filter_type: WeirdBase64Token
992 min_line_len: 18
993 required_regex: "[0-9A-Za-z_/+-]{15}"
994 target:
995 - code
996 - doc
997
998- name: Bitbucket Client Secret
999 severity: info
1000 confidence: weak
1001 type: pattern
1002 values:
1003 - (?<![.0-9A-Za-z_/+-])(?P<value>([0-9A-Za-z_-]{32}){1,2})(?![0-9A-Za-z.$_/+-])
1004 filter_type: WeirdBase64Token
1005 min_line_len: 32
1006 required_regex: "[0-9A-Za-z_/+-]{15}"
1007 target:
1008 - code
1009 - doc
1010
1011- name: Jira / Confluence PAT token
1012 severity: high
1013 confidence: strong
1014 type: pattern
1015 values:
1016 - (?<![0-9A-Za-z_-])(?P<value>[NMO][ADgjQTwz][0-9A-Za-z_-]{42})(?![0-9A-Za-z_-])
1017 filter_type:
1018 - ValueAtlassianTokenCheck
1019 min_line_len: 44
1020 required_substrings:
1021 - M
1022 - N
1023 - O
1024 required_regex: "[0-9A-Za-z_/+-]{15}"
1025 target:
1026 - code
1027 - doc
1028
1029- name: Atlassian Old PAT token
1030 severity: info
1031 confidence: weak
1032 type: pattern
1033 values:
1034 - (?<![.0-9A-Za-z_/+-])(?P<value>[0-9A-Za-z]{24})(?![=0-9A-Za-z.$_/+-])
1035 filter_type: WeirdBase64Token
1036 min_line_len: 24
1037 required_regex: "[0-9A-Za-z_/+-]{15}"
1038 target:
1039 - code
1040 - doc
1041
1042- name: Atlassian PAT token
1043 severity: high
1044 confidence: strong
1045 type: pattern
1046 values:
1047 - (?<![0-9A-Za-z_-])(?P<value>ATATT3xFfGF0[0-9A-Za-z_-]{80,800}(\\?=|%3[dD])[A-F0-9]{8})(?![0-9A-Za-z_-])
1048 filter_type:
1049 - ValueAtlassianTokenCheck
1050 min_line_len: 160
1051 required_substrings:
1052 - ATATT3xFfGF0
1053 target:
1054 - code
1055 - doc
1056
1057- name: Digital Ocean Token
1058 severity: high
1059 confidence: strong
1060 type: pattern
1061 values:
1062 - (?<![0-9A-Za-z_-])(?P<value>do[op]_v1_[a-f0-9]{64})(?![0-9A-Za-z_-])
1063 filter_type: TokenPattern
1064 min_line_len: 71
1065 required_substrings:
1066 - doo_v1_
1067 - dop_v1_
1068 target:
1069 - code
1070 - doc
1071
1072- name: Dropbox OAuth2 API Access Token
1073 severity: high
1074 confidence: moderate
1075 type: pattern
1076 values:
1077 - (?<![0-9A-Za-z_-])(?P<value>sl.[0-9A-Za-z_-]{135})(?![0-9A-Za-z_-])
1078 filter_type: TokenPattern
1079 min_line_len: 138
1080 required_substrings:
1081 - sl.
1082 target:
1083 - code
1084 - doc
1085
1086- name: NuGet API key
1087 severity: high
1088 confidence: moderate
1089 type: pattern
1090 values:
1091 - (?<![0-9A-Za-z_-])(?P<value>oy2[a-z0-9]{43})(?![0-9A-Za-z_-])
1092 filter_type: TokenPattern
1093 min_line_len: 46
1094 required_substrings:
1095 - oy2
1096 target:
1097 - code
1098 - doc
1099
1100- name: Gitlab Prefix Token
1101 severity: high
1102 confidence: strong
1103 type: pattern
1104 values:
1105 - (?<![0-9A-Za-z_-])(?P<value>(_gitlab_session=|GR1348941|gl(agent|soat|ffct|p[at]t|oas|cbt|imt|[dfr]t)-)[0-9A-Za-z_-]{20,64})(?![0-9A-Za-z_-])
1106 filter_type:
1107 - ValuePatternCheck
1108 min_line_len: 25
1109 required_substrings:
1110 - _gitlab_session=
1111 - GR1348941
1112 - glagent-
1113 - glsoat-
1114 - glffct-
1115 - glpat-
1116 - gloas-
1117 - glptt-
1118 - glcbt-
1119 - glimt-
1120 - gldt-
1121 - glft-
1122 - glrt-
1123 target:
1124 - code
1125 - doc
1126
1127- name: Grafana Provisioned API Key
1128 severity: high
1129 confidence: strong
1130 type: pattern
1131 values:
1132 - (?<![0-9A-Za-z_-])(?P<value>eyJ[=0-9A-Za-z_-]{64,360})(?![0-9A-Za-z_-])
1133 filter_type:
1134 - ValueGrafanaCheck
1135 min_line_len: 67
1136 required_substrings:
1137 - eyJ
1138 target:
1139 - code
1140 - doc
1141
1142- name: Grafana Access Policy Token
1143 severity: high
1144 confidence: strong
1145 type: pattern
1146 values:
1147 - (?<![0-9A-Za-z_-])(?P<value>glc_eyJ[0-9A-Za-z_-]{80,360})(?![0-9A-Za-z_-])
1148 filter_type:
1149 - ValueGrafanaCheck
1150 min_line_len: 87
1151 required_substrings:
1152 - glc_eyJ
1153 target:
1154 - code
1155 - doc
1156
1157- name: Dropbox API secret (long term)
1158 severity: high
1159 confidence: weak
1160 type: pattern
1161 values:
1162 - (?<![0-9A-Za-z_-])(?=[0-9A-Za-z]{64})(?P<value>[0-9A-Za-z]{10,12}[B-Za-z0-9]A{10,12}[B-Za-z0-9][0-9A-Za-z]{40,44})(?![=0-9A-Za-z_-])
1163 filter_type: []
1164 min_line_len: 43
1165 required_substrings:
1166 - AAAAAAAAAA
1167 target:
1168 - code
1169 - doc
1170
1171- name: Dropbox App secret
1172 severity: info
1173 confidence: weak
1174 type: pattern
1175 values:
1176 - (?<![.0-9A-Za-z_/+-])(?P<value>[a-z0-9]{15})(?![=0-9A-Za-z_/+-])
1177 filter_type: WeirdBase36Token
1178 min_line_len: 15
1179 required_regex: "[0-9A-Za-z_/+-]{15}"
1180 target:
1181 - code
1182 - doc
1183
1184- name: Gitlab Incoming Email Token
1185 severity: info
1186 confidence: weak
1187 type: pattern
1188 values:
1189 - (?<![.0-9A-Za-z_/+-])(?P<value>[a-z0-9]{24,25})(?![=0-9A-Za-z_/+-])
1190 filter_type: WeirdBase36Token
1191 min_line_len: 24
1192 required_regex: "[0-9A-Za-z_/+-]{15}"
1193 target:
1194 - code
1195 - doc
1196
1197- name: Gitlab Feed Token
1198 severity: info
1199 confidence: weak
1200 type: pattern
1201 values:
1202 - (?<![.0-9A-Za-z_/+-])(?P<value>[0-9A-Za-z_-]{20})(?![=0-9A-Za-z_/+-])
1203 filter_type: WeirdBase64Token
1204 min_line_len: 20
1205 required_regex: "[0-9A-Za-z_/+-]{15}"
1206 target:
1207 - code
1208 - doc
1209
1210- name: Hashicorp Terraform Token
1211 severity: high
1212 confidence: strong
1213 type: pattern
1214 values:
1215 - (?<![.0-9A-Za-z_-])(?P<value>[0-9A-Za-z_-]{14}\.atlasv1\.[0-9A-Za-z_-]{67})(?![0-9A-Za-z_-])
1216 filter_type:
1217 - ValuePatternCheck
1218 min_line_len: 90
1219 required_substring:
1220 - .atlasv1.
1221 target:
1222 - code
1223 - doc
1224
1225- name: Jira 2FA
1226 severity: info
1227 confidence: weak
1228 type: pattern
1229 values:
1230 - (?<![.0-9A-Za-z_/+-])(?P<value>[A-Z2-7]{16})(?![=0-9A-Za-z_/+-])
1231 filter_type:
1232 - ValueCoupleKeywordCheck
1233 - ValuePatternCheck
1234 - ValueEntropyBase32Check
1235 - ValueBase32DataCheck
1236 - ValueTokenBase32Check
1237 min_line_len: 16
1238 required_regex: "[0-9A-Za-z_/+-]{15}"
1239 target:
1240 - code
1241 - doc
1242
1243- name: OpenAI Token
1244 severity: high
1245 confidence: strong
1246 type: pattern
1247 values:
1248 - (?<![.0-9A-Za-z_-])(?P<value>sk-[0-9A-Za-z_-]{16,32}(T3BlbkFJ|9wZW5BS|PcGVuQU)[0-9A-Za-z_-]{16,32})(?![0-9A-Za-z_-])
1249 min_line_len: 51
1250 filter_type:
1251 - ValuePatternCheck
1252 - ValueEntropyBase64Check
1253 required_substrings:
1254 - T3BlbkFJ
1255 - 9wZW5BS
1256 - PcGVuQU
1257 target:
1258 - code
1259 - doc
1260
1261- name: Docker Swarm Token
1262 severity: high
1263 confidence: strong
1264 type: pattern
1265 values:
1266 - (?<![.0-9A-Za-z_-])(?P<value>SWMTKN-1-[0-9a-z]{50}-[0-9a-z]{25})(?![0-9A-Za-z_-])
1267 min_line_len: 85
1268 filter_type:
1269 - ValueCoupleKeywordCheck
1270 required_substrings:
1271 - SWMTKN-1-
1272 target:
1273 - code
1274 - doc
1275
1276- name: Groq API Key
1277 severity: high
1278 confidence: strong
1279 type: pattern
1280 values:
1281 - (?<![0-9A-Za-z_-])(?P<value>gsk_[0-9A-Za-z_-]{52})(?![0-9A-Za-z_-])
1282 min_line_len: 56
1283 filter_type:
1284 - ValuePatternCheck
1285 - ValueEntropyBase64Check
1286 required_substrings:
1287 - gsk_
1288 target:
1289 - code
1290 - doc
1291
1292- name: Hugging Face User Access Token
1293 severity: high
1294 confidence: moderate
1295 type: pattern
1296 values:
1297 - (?<![0-9A-Za-z_-])(?P<value>hf_[0-9A-Za-z_-]{34})(?![0-9A-Za-z_-])
1298 min_line_len: 37
1299 filter_type:
1300 - ValuePatternCheck
1301 - ValueEntropyBase64Check
1302 required_substrings:
1303 - hf_
1304 target:
1305 - code
1306 - doc
1307
1308- name: Discord Bot Token
1309 severity: high
1310 confidence: strong
1311 type: pattern
1312 values:
1313 - (?<![0-9A-Za-z_-])(?P<value>[NMO][ADgjQTwz][0-9A-Za-z_-]{22,26}\.[0-9A-Za-z_-]{6}\.[0-9A-Za-z_-]{30,40})(?![0-9A-Za-z_-])
1314 min_line_len: 62
1315 filter_type:
1316 - ValueDiscordBotCheck
1317 required_substrings:
1318 - M
1319 - N
1320 - O
1321 required_regex: "[0-9A-Za-z_/+-]{15}"
1322 target:
1323 - code
1324 - doc
1325
1326- name: Grafana Service Account Token
1327 severity: high
1328 confidence: strong
1329 type: pattern
1330 values:
1331 - (?<![0-9A-Za-z_-])(?P<value>glsa_[0-9A-Za-z_-]{32}_[0-9A-Fa-f]{8})(?![0-9A-Za-z_-])
1332 min_line_len: 46
1333 filter_type:
1334 - ValueGrafanaServiceCheck
1335 required_substrings:
1336 - glsa_
1337 target:
1338 - code
1339 - doc