1- name: SECRET_PAIR
2 severity: medium
3 confidence: moderate
4 type: pattern
5 values:
6 - (?P<variable>[`'\"]?(?i:token|secret|key|키|암호|암호화|토큰)[`'\"]?)((\s)*[=:](\s)*)(?P<quote>[`'\"(])?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){8,80}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)[)`'\"])
7 filter_type:
8 - ValueAllowlistCheck
9 - ValuePatternCheck
10 - ValueEntropyBase64Check
11 - ValueCoupleKeywordCheck
12 min_line_len: 16
13 required_substrings:
14 - token
15 - secret
16 - key
17 - 키
18 - 암호
19 - 암호화
20 - 토큰
21 target:
22 - doc
23
24- name: PASSWD_PAIR
25 severity: medium
26 confidence: moderate
27 type: pattern
28 values:
29 - (?P<variable>[`'\"]?(?i:(?<!id[ :/])pa[as]swo?r?ds?|pwd?|p/w|비밀번호|비번|패스워드|암호)[`'\"]?)((\s)*[=:](\s)*)(?P<quote>[`'\"(])?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){8,31}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)[)`'\"])
30 filter_type:
31 - ValueAllowlistCheck
32 - ValuePatternCheck
33 - ValueDictionaryKeywordCheck
34 - LineGitBinaryCheck
35 - LineUUEPartCheck
36 - ValueFilePathCheck
37 - ValueHexNumberCheck
38 min_line_len: 10
39 required_substrings:
40 - pass
41 - sword
42 - pw
43 - p/w
44 - paasw
45 - 비밀번호
46 - 비번
47 - 패스워드
48 - 암호
49 target:
50 - doc
51
52- name: IP_ID_PASSWORD_TRIPLE
53 severity: medium
54 confidence: moderate
55 type: pattern
56 values:
57 - (^|\s|(?P<variable>(?i:\bip[\s/]{1,80}id[\s/]{1,80}pw[\s/:]{0,80}))|(?P<url>://))(?P<ip>[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2})((\s*\()?|(?(variable)[\s,/]{1,80}|(?(url)[,]|[,/])))\s*\w[\w.-]{3,80}[\s,/]{1,80}(?P<value>(?(url)(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9_+=~!@#$%^&*;?-])){7,31}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x)|(?-i:(?P<e>[A-Z])|(?P<f>[a-z])|(?P<g>[0-9/_+=~!@#$%^&*;?-])){7,31}(?(e)(?(f)(?(g)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x)))(?:\s|[^/]|$)
58 filter_type:
59 - ValueAllowlistCheck
60 - ValuePatternCheck
61 - ValueDictionaryKeywordCheck
62 min_line_len: 10
63 required_substrings:
64 - "."
65 target:
66 - doc
67
68- name: ID_PAIR_PASSWD_PAIR
69 severity: medium
70 confidence: moderate
71 type: pattern
72 values:
73 - (?P<ddash>--)?(?P<variable>\w*(?i:pa[as]swords?|passwd?|pwd|\bp/w|\bpw|비밀번호|비번|패스워드|암호))\s*?(?(ddash)[ =]|[:=/>-]{1,2})\s*(?P<quote>[`'\"]{1,8})?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){4,31}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)(?P=quote)|(\s|$))
74 - (?P<ddash>--)?(?P<variable>(?i:user\s*)?(?i:id|login|account|root|admin|user|name|wifi|role|host|default|계정|아이디))\s*?(?(ddash)[ =]|[ :=])\s*?(?P<value>\S+)
75 filter_type:
76 - ValueAllowlistCheck
77 - ValuePatternCheck
78 min_line_len: 10
79 required_substrings:
80 - pass
81 - sword
82 - p/w
83 - pw
84 - 비밀번호
85 - 비번
86 - 패스워드
87 - 암호
88 target:
89 - doc
90
91- name: ID_PASSWD_PAIR
92 severity: medium
93 confidence: moderate
94 type: pattern
95 values:
96 - (?P<variable>[\w.-]{0,80}(?i:(?P<id>\bid\b)|id\b|user|name|계정|아이디)[\w.-]{0,80}(?(id)[ :(/]{1,80}|[:(/]{1,80})(?i:pa[as]swo?r?ds?|pwd?|비밀번호|비번|패스워드|암호))\)?(\s*->\s*|[ =:)(/]{1,80}|\s+is\s+|\s+are\s+|\s*는\s*|\s*은\s*|\s*설정은\s*)\(?(?P<id_value>[\w.-]{2,31})[ :\(/\"',]{1,80}(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){4,31}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))
97 filter_type:
98 - ValueAllowlistCheck
99 - ValuePatternCheck
100 - ValueDictionaryKeywordCheck
101 min_line_len: 10
102 required_substrings:
103 - pw
104 - pass
105 - sword
106 - 비밀번호
107 - 비번
108 - 패스워드
109 - 암호
110 target:
111 - doc
112
113- name: API
114 severity: medium
115 confidence: moderate
116 type: keyword
117 values:
118 - api(?!tal)
119 filter_type: GeneralKeyword
120 use_ml: true
121 min_line_len: 11
122 required_substrings:
123 - api
124 target:
125 - code
126
127- name: UUID
128 severity: info
129 confidence: strong
130 type: pattern
131 values:
132 - (?<![0-9A-Za-z_-])(?P<value>[0-9A-Fa-f]{8}(-[0-9A-Fa-f]{4}){3}-[0-9A-Fa-f]{12})(?![0-9A-Za-z_-])
133 min_line_len: 36
134 required_substrings:
135 - "-"
136 required_regex: "[0-9A-Za-z_/+-]{15}"
137 filter_type:
138 - ValuePatternCheck
139 use_ml: false
140 target:
141 - code
142 - doc
143
144- name: AWS Client ID
145 severity: high
146 confidence: moderate
147 type: pattern
148 values:
149 - (?<![0-9A-Za-z_-])(?P<value>(ABIA|ACCA|AGPA|AIDA|AIPA|AKIA|ANPA|ANVA|AROA|APKA|ASCA|ASIA)[0-9A-Z]{16,17})(?![0-9A-Za-z_-])
150 filter_type: GeneralPattern
151 required_substrings:
152 - A
153 min_line_len: 20
154 required_regex: "[0-9A-Za-z_/+-]{15}"
155 target:
156 - code
157 - doc
158
159- name: AWS Multi
160 severity: high
161 confidence: moderate
162 type: multi
163 values:
164 - (?<![0-9A-Za-z_-])(?P<value>(ABIA|ACCA|AGPA|AIDA|AIPA|AKIA|ANPA|ANVA|AROA|APKA|ASCA|ASIA)[0-9A-Z]{16,17})(?![0-9A-Za-z_-])
165 - (?<![0-9A-Za-z_/+-])(?P<value>[0-9A-Za-z/+]{35,80})(?![0-9A-Za-z_/+-])
166 filter_type:
167 - LineSpecificKeyCheck
168 - ValuePatternCheck
169 - ValueCoupleKeywordCheck(3)
170 required_substrings:
171 - A
172 min_line_len: 20
173 required_regex: "[0-9A-Za-z_/+-]{15}"
174 target:
175 - code
176 - doc
177
178- name: AWS MWS Key
179 severity: high
180 confidence: strong
181 type: pattern
182 values:
183 - (?<![0-9A-Za-z_-])(?P<value>amzn\.mws\.[0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12})(?![0-9A-Za-z_-])
184 filter_type: GeneralPattern
185 required_substrings:
186 - amzn
187 min_line_len: 30
188 target:
189 - code
190 - doc
191
192- name: Credential
193 severity: medium
194 confidence: moderate
195 type: keyword
196 values:
197 - credential
198 filter_type: GeneralKeyword
199 use_ml: true
200 min_line_len: 18
201 required_substrings:
202 - credential
203 target:
204 - code
205
206- name: Dynatrace API Token
207 severity: high
208 confidence: moderate
209 type: pattern
210 values:
211 - (?<![0-9A-Za-z_-])(?P<value>dt0[A-Za-z]{1}[0-9]{2}\.[0-9A-Z]{24}\.[0-9A-Z]{64})(?![0-9A-Za-z_-])
212 filter_type: GeneralPattern
213 required_substrings:
214 - dt0
215 min_line_len: 90
216 target:
217 - code
218 - doc
219
220- name: Facebook Access Token
221 severity: high
222 confidence: moderate
223 type: pattern
224 values:
225 - (?<![0-9A-Za-z_-])(?P<value>EAA[0-9A-Za-z]{80,800})
226 filter_type:
227 - ValuePatternCheck
228 - ValueBase64PartCheck
229 required_substrings:
230 - EAA
231 min_line_len: 80
232 target:
233 - code
234 - doc
235
236- name: Facebook App Token
237 severity: high
238 confidence: moderate
239 type: pattern
240 values:
241 - (?<![0-9A-Za-z_-])(?P<value>[0-9]{12,18}\|[0-9A-Za-z_-]{24,28})(?![0-9A-Za-z_-])
242 filter_type: GeneralPattern
243 required_substrings:
244 - "|"
245 required_regex: "[0-9A-Za-z_/+-]{15}"
246 min_line_len: 33
247 target:
248 - code
249 - doc
250
251- name: Github Old Token
252 severity: high
253 confidence: moderate
254 type: pattern
255 values:
256 - (?i)((git)[0-9A-Za-z_-]{0,80}(token|key|api)[0-9A-Za-z_-]{0,80}(\s)*(=|:|:=)(\s)*(["']?)(?P<value>[0-9a-z]{40})(["']?))
257 filter_type: GeneralPattern
258 use_ml: true
259 validations:
260 - GithubTokenValidation
261 required_substrings:
262 - git
263 min_line_len: 47
264 target:
265 - code
266 - doc
267
268- name: Google API Key
269 severity: high
270 confidence: moderate
271 type: pattern
272 values:
273 - (?<![0-9A-Za-z_-])(?P<value>AIza[0-9A-Za-z_-]{35})(?![0-9A-Za-z_-])
274 filter_type: GeneralPattern
275 validations:
276 - GoogleApiKeyValidation
277 required_substrings:
278 - AIza
279 min_line_len: 39
280 target:
281 - code
282 - doc
283
284- name: Google Multi
285 severity: high
286 confidence: moderate
287 type: multi
288 values:
289 - (?P<value>[0-9]{3,80}-[0-9a-z_]{32}\.apps\.googleusercontent\.com)
290 - \b(?P<value>GOCSPX-[0-9A-Za-z_-]{28}|((?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9_-])){24,80}(?(a)(?(b)(?(c)\b|(?!x)x)|(?!x)x)|(?!x)x))
291 filter_type: GeneralPattern
292 validations:
293 - GoogleMultiValidation
294 required_substrings:
295 - .apps.googleusercontent.com
296 min_line_len: 40
297 target:
298 - code
299 - doc
300
301- name: Google OAuth Secret
302 severity: high
303 confidence: strong
304 type: pattern
305 values:
306 - (?<![0-9A-Za-z_-])(?P<value>GOCSPX-[0-9A-Za-z_-]{28})(?![0-9A-Za-z_-])
307 filter_type: GeneralPattern
308 required_substrings:
309 - GOCSPX-
310 min_line_len: 40
311 target:
312 - code
313 - doc
314
315- name: Google OAuth Access Token
316 severity: high
317 confidence: moderate
318 type: pattern
319 values:
320 - (?<![0-9A-Za-z_-])(?P<value>ya29\.[0-9A-Za-z_-]{22,8000})
321 filter_type: GeneralPattern
322 required_substrings:
323 - ya29.
324 min_line_len: 27
325 target:
326 - code
327 - doc
328
329- name: Heroku API Key
330 severity: high
331 confidence: moderate
332 type: pattern
333 values:
334 - (?i)(?P<value>heroku(.{0,20})?[0-9a-f]{8}(-[0-9a-f]{4})+-[0-9a-f]{12})(?![0-9A-Za-z_-])
335 filter_type: GeneralPattern
336 required_substrings:
337 - heroku
338 min_line_len: 24
339 target:
340 - code
341 - doc
342
343- name: Instagram Access Token
344 severity: high
345 confidence: strong
346 type: pattern
347 values:
348 - (?<![0-9A-Za-z_-])(?P<value>IGQVJ[0-9A-Za-z_=-]{100,8000})
349 filter_type: GeneralPattern
350 required_substrings:
351 - IGQVJ
352 min_line_len: 105
353 target:
354 - code
355 - doc
356
357- name: JSON Web Token
358 severity: medium
359 confidence: strong
360 type: pattern
361 values:
362 - (?<![0-9A-Za-z_-])(?P<value>eyJ[0-9A-Za-z_+/=-]{15,8000}(\.[0-9A-Za-z_+/=-]{0,8000}){2,16})
363 filter_type:
364 - ValueJsonWebTokenCheck
365 required_substrings:
366 - eyJ
367 min_line_len: 18
368 target:
369 - code
370 - doc
371
372- name: MailChimp API Key
373 severity: high
374 confidence: moderate
375 type: pattern
376 values:
377 - (?<![0-9A-Za-z_-])(?P<value>[0-9A-Za-z_-]{32}-us[0-9]{1,2})(?![0-9A-Za-z_-])
378 filter_type: GeneralPattern
379 validations:
380 - MailChimpKeyValidation
381 required_substrings:
382 - -us
383 min_line_len: 35
384 target:
385 - code
386 - doc
387
388- name: MailGun API Key
389 severity: high
390 confidence: moderate
391 type: pattern
392 values:
393 - (?<![0-9A-Za-z_-])(?P<value>key-[0-9A-Za-z_-]{32})(?![0-9A-Za-z_-])
394 filter_type: GeneralPattern
395 required_substrings:
396 - key-
397 min_line_len: 36
398 target:
399 - code
400 - doc
401
402- name: Password
403 severity: medium
404 confidence: moderate
405 type: keyword
406 values:
407 - (?<!by)pass(?!ed|ing|es|\s+[a-z]{3,80})|pw(d|\b)
408 filter_type: PasswordKeyword
409 use_ml: true
410 min_line_len: 10
411 required_substrings:
412 - pass
413 - pw
414 target:
415 - code
416
417- name: PayPal Braintree Access Token
418 severity: high
419 confidence: strong
420 type: pattern
421 values:
422 - (?P<value>access_token\$production\$[0-9a-z]{16}\$[0-9a-z]{32})(?![0-9A-Za-z_-])
423 filter_type: GeneralPattern
424 required_substrings:
425 - access_token$production$
426 min_line_len: 72
427 target:
428 - code
429 - doc
430
431- name: PEM Private Key
432 severity: high
433 confidence: strong
434 type: pem_key
435 values:
436 - (?P<value>-----BEGIN\s(?!ENCRYPTED)[^-]{0,80}PRIVATE[^-]{0,80}KEY[^-]{0,40}-----(.+-----END[^-]{1,80}KEY[^-]{0,40}-----)?)
437 min_line_len: 27
438 target:
439 - code
440 - doc
441
442- name: BASE64 encoded PEM Private Key
443 severity: high
444 confidence: strong
445 type: pattern
446 values:
447 - (?P<value>[0-9A-Za-z_/+-]{0,8000}LS0t(LS1CRUdJTiB|LUJFR0lOI|QkVHSU4g)[0-9A-Za-z_/+-]{0,11}(UFJJVkFURSBLRVkt|QUklWQVRFIEtFWS0t|FBSSVZBVEUgS0VZ)[0-9A-Za-z_/+-]{1,8000}LS0t[0-9A-Za-z_/+-]{1,8000})
448 filter_type:
449 - ValueBase64EncodedPem
450 min_line_len: 300
451 required_substrings:
452 - UFJJVkFURSBLRVkt
453 - QUklWQVRFIEtFWS0t
454 - FBSSVZBVEUgS0VZ
455 target:
456 - code
457 - doc
458
459- name: BASE64 Private Key
460 severity: high
461 confidence: strong
462 type: pattern
463 values:
464 - (?P<value>\bMII[A-Za-f][0-9A-Za-z/+]{8}(?s:[^!#$&()*\-.:;<=>?@\[\]^_{|}~]{8,8000}))
465 filter_type:
466 - ValueBase64KeyCheck
467 min_line_len: 160
468 required_substrings:
469 - MII
470 target:
471 - code
472 - doc
473
474- name: Picatic API Key
475 severity: high
476 confidence: strong
477 type: pattern
478 values:
479 - (?P<value>sk_live_[0-9a-z]{32})(?![0-9A-Za-z_-])
480 filter_type: GeneralPattern
481 required_substrings:
482 - sk_live_
483 min_line_len: 40
484 target:
485 - code
486 - doc
487
488- name: Secret
489 severity: medium
490 confidence: moderate
491 type: keyword
492 values:
493 - secret
494 filter_type: GeneralKeyword
495 use_ml: true
496 min_line_len: 14
497 required_substrings:
498 - secret
499 target:
500 - code
501
502- name: SendGrid API Key
503 severity: high
504 confidence: moderate
505 type: pattern
506 values:
507 - (?P<value>SG\.[0-9A-Za-z_-]{16,32}\.[0-9A-Za-z_-]{16,64})
508 filter_type: GeneralPattern
509 required_substrings:
510 - SG.
511 min_line_len: 34
512 target:
513 - code
514 - doc
515
516- name: Shopify Token
517 severity: high
518 confidence: strong
519 type: pattern
520 values:
521 - (?P<value>shp(at|ca|pa|ss)_[0-9A-Fa-f]{32})(?![0-9A-Za-z_-])
522 filter_type: TokenPattern
523 required_substrings:
524 - shp
525 min_line_len: 38
526 target:
527 - code
528 - doc
529
530- name: Slack Token
531 severity: high
532 confidence: strong
533 type: pattern
534 values:
535 - (?<![0-9A-Za-z_-])(?P<value>xox[aboprst]\-[0-9A-Za-z-]{10,250})
536 filter_type: GeneralPattern
537 validations:
538 - SlackTokenValidation
539 required_substrings:
540 - xox
541 min_line_len: 15
542 target:
543 - code
544 - doc
545
546- name: Slack Webhook
547 severity: high
548 confidence: strong
549 type: pattern
550 values:
551 - (?P<value>hooks\.slack\.com/services/T[0-9A-Z]{8,16}/B[0-9A-Z]{8,16}/\w{24})
552 filter_type: GeneralPattern
553 required_substrings:
554 - hooks.slack.com/services/T
555 min_line_len: 61
556 target:
557 - code
558 - doc
559
560- name: Stripe Standard API Key
561 severity: high
562 confidence: strong
563 type: pattern
564 values:
565 - (?P<value>sk_live_[0-9A-Za-z_-]{24})(?![0-9A-Za-z_-])
566 filter_type: GeneralPattern
567 validations:
568 - StripeApiKeyValidation
569 required_substrings:
570 - sk_live_
571 min_line_len: 32
572 target:
573 - code
574 - doc
575
576- name: Stripe Restricted API Key
577 severity: high
578 confidence: strong
579 type: pattern
580 values:
581 - (?P<value>rk_live_[0-9A-Za-z_-]{24})(?![0-9A-Za-z_-])
582 filter_type: GeneralPattern
583 required_substrings:
584 - rk_live_
585 min_line_len: 32
586 target:
587 - code
588 - doc
589
590- name: Square Access Token
591 severity: high
592 confidence: moderate
593 type: pattern
594 values:
595 - (?<![0-9A-Za-z_-])(?P<value>EAAA[0-9A-Za-z_-]{60})(?![0-9A-Za-z_-])
596 filter_type:
597 - ValuePatternCheck
598 - ValueBase64PartCheck
599 validations:
600 - SquareAccessTokenValidation
601 required_substrings:
602 - EAAA
603 min_line_len: 64
604 target:
605 - code
606 - doc
607
608- name: Square Client ID
609 severity: medium
610 confidence: strong
611 type: pattern
612 values:
613 - (?<![0-9A-Za-z_-])(?P<value>sq0[a-z]{3}-[0-9A-Za-z_-]{22})(?![0-9A-Za-z_-])
614 filter_type: GeneralPattern
615 validations:
616 - SquareClientIdValidation
617 required_substrings:
618 - sq0
619 min_line_len: 29
620 target:
621 - code
622 - doc
623
624- name: Square OAuth Secret
625 severity: high
626 confidence: strong
627 type: pattern
628 values:
629 - (?P<value>sq0csp-[0-9A-Za-z_-]{43})(?![0-9A-Za-z_-])
630 filter_type: GeneralPattern
631 required_substrings:
632 - sq0csp
633 min_line_len: 50
634 target:
635 - code
636 - doc
637
638- name: Token
639 severity: medium
640 confidence: moderate
641 type: keyword
642 values:
643 - token(?!ize)
644 filter_type: GeneralKeyword
645 use_ml: true
646 min_line_len: 13
647 required_substrings:
648 - token
649 target:
650 - code
651
652- name: Twilio Credentials
653 severity: high
654 confidence: moderate
655 type: pattern
656 values:
657 - (?<![0-9A-Za-z_-])(?P<value>(AC|AD|AL|CA|CF|CL|CN|CR|FW|IP|KS|MM|NO|PK|PN|QU|RE|SC|SD|SK|SM|TR|UT|XE|XR)[0-9A-Fa-f]{32})(?![0-9A-Za-z_-])
658 filter_type: TokenPattern
659 required_substrings:
660 - AC
661 - AD
662 - AL
663 - CA
664 - CF
665 - CL
666 - CN
667 - CR
668 - FW
669 - IP
670 - KS
671 - MM
672 - "NO"
673 - PK
674 - PN
675 - QU
676 - RE
677 - SC
678 - SD
679 - SK
680 - SM
681 - TR
682 - UT
683 - XE
684 - XR
685 min_line_len: 34
686 target:
687 - code
688 - doc
689
690- name: CMD ConvertTo-SecureString
691 severity: high
692 confidence: moderate
693 type: pattern
694 values:
695 - (^|\W|\\[tnr])(?P<variable>ConvertTo-SecureString(\s\s*-(String|AsPlainText|Force))*)\s\s*(?P<value_leftquote>(\\?[\"']){1,3})?(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,800})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
696 filter_type: GeneralKeyword
697 use_ml: true
698 required_substrings:
699 - convertto-securestring
700 min_line_len: 27
701 target:
702 - code
703
704- name: CMD Password
705 severity: high
706 confidence: moderate
707 type: pattern
708 values:
709 - (^|\W|\\[tnr])(?P<variable>-[A-Za-z_-]*(?i:pass(in|out|word|phrase)))\s\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(pass:)?(?!file:|env:|fd:)(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,80})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
710 filter_type: GeneralKeyword
711 use_ml: true
712 required_substrings:
713 - pass
714 min_line_len: 12
715 target:
716 - code
717
718- name: CMD Token
719 severity: high
720 confidence: moderate
721 type: pattern
722 values:
723 - (^|\W|\\[tnr])(?P<variable>-[A-Za-z_-]*(?i:token))\s\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,4000})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
724 filter_type: GeneralKeyword
725 use_ml: true
726 required_substrings:
727 - token
728 min_line_len: 12
729 target:
730 - code
731
732- name: CMD Secret
733 severity: high
734 confidence: moderate
735 type: pattern
736 values:
737 - (^|\W|\\[tnr])(?P<variable>-[A-Za-z_-]*(?i:secret)[A-Za-z_-]*)\s\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(pass:)?(?!file:|env:|fd:)(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,4000})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
738 filter_type: GeneralKeyword
739 use_ml: true
740 required_substrings:
741 - secret
742 min_line_len: 12
743 target:
744 - code
745
746- name: URL Credentials
747 severity: high
748 confidence: moderate
749 type: pattern
750 values:
751 - (?P<value_leftquote>[\"'])?(?P<variable>[+0-9A-Za-z-]{2,80}://)([^\s\'"<>\[\]^~`{|}:/]{0,80}:){1,3}(?P<value>[^\s\'"<>\[\]^~`{|}@:/]{3,80})@[^\s\'"<>\[\]^~`{|}@:/]{1,800}\\{0,8}(?P<value_rightquote>[\"'])?
752 filter_type: UrlCredentialsGroup
753 use_ml: true
754 required_substrings:
755 - ://
756 min_line_len: 10
757 target:
758 - code
759
760- name: Auth
761 severity: medium
762 confidence: moderate
763 type: keyword
764 values:
765 - auth(?!ors?(?!i[tz]))
766 filter_type: GeneralKeyword
767 use_ml: true
768 min_line_len: 12
769 required_substrings:
770 - auth
771 target:
772 - code
773
774- name: Key
775 severity: medium
776 confidence: moderate
777 type: keyword
778 values:
779 - key(?!word|board|pad|name)
780 filter_type: GeneralKeyword
781 use_ml: true
782 min_line_len: 11
783 required_substrings:
784 - key
785 target:
786 - code
787
788- name: Telegram Bot API Token
789 severity: high
790 confidence: moderate
791 type: pattern
792 values:
793 - (?P<value>[0-9]{8,10}:[0-9A-Za-z_-]{35})(?![0-9A-Za-z_-])
794 filter_type: GeneralPattern
795 required_substrings:
796 - :AA
797 min_line_len: 45
798 target:
799 - code
800 - doc
801
802- name: PyPi API Token
803 severity: high
804 confidence: strong
805 type: pattern
806 values:
807 - (?P<value>pypi-[0-9A-Za-z_-]{150,8000})
808 filter_type: GeneralPattern
809 required_substrings:
810 - pypi-
811 min_line_len: 155
812 target:
813 - code
814 - doc
815
816- name: Github Classic Token
817 severity: high
818 confidence: strong
819 type: pattern
820 values:
821 - (?<![0-9A-Za-z_-])(?P<value>gh[pousr]_[0-9A-Za-z_-]{36,255})
822 filter_type:
823 - ValueGitHubCheck
824 validations:
825 - GithubTokenValidation
826 required_substrings:
827 - ghp_
828 - gho_
829 - ghu_
830 - ghs_
831 - ghr_
832 min_line_len: 40
833 target:
834 - code
835 - doc
836
837- name: Github Fine-granted Token
838 severity: high
839 confidence: strong
840 type: pattern
841 values:
842 - (?<![0-9A-Za-z_-])(?P<value>github_pat_[0-9A-Za-z_]{80,255})
843 filter_type: GeneralPattern
844 validations:
845 - GithubTokenValidation
846 required_substrings:
847 - github_pat_
848 min_line_len: 90
849 target:
850 - code
851 - doc
852
853- name: Firebase Domain
854 severity: info
855 confidence: moderate
856 type: pattern
857 values:
858 - (?<![0-9A-Za-z_])(?P<value>[a-z0-9.-]{1,80}\.firebaseio\.com|[a-z0-9.-]{1,80}\.firebaseapp\.com)
859 filter_type: GeneralPattern
860 required_substrings:
861 - .firebase
862 min_line_len: 16
863 target:
864 - code
865 - doc
866
867- name: AWS S3 Bucket
868 severity: info
869 confidence: moderate
870 type: pattern
871 values:
872 - (?<![0-9A-Za-z_])(?P<value>[a-z0-9.-]{3,63}\.s3\.amazonaws\.com|[a-z0-9.-]{3,63}\.s3-website[.-](eu|ap|us|ca|sa|cn))
873 filter_type: GeneralPattern
874 required_substrings:
875 - .s3-website
876 - .s3.amazonaws.com
877 min_line_len: 14
878 target:
879 - code
880 - doc
881
882- name: Nonce
883 severity: medium
884 confidence: moderate
885 type: keyword
886 values:
887 - nonce
888 filter_type: GeneralKeyword
889 use_ml: true
890 min_line_len: 13
891 required_substrings:
892 - nonce
893 target:
894 - code
895
896- name: Salt
897 severity: medium
898 confidence: moderate
899 type: keyword
900 values:
901 - salt
902 filter_type: GeneralKeyword
903 use_ml: true
904 min_line_len: 12
905 required_substrings:
906 - salt
907 target:
908 - code
909
910- name: Certificate
911 severity: medium
912 confidence: moderate
913 type: keyword
914 values:
915 - cert
916 filter_type: GeneralKeyword
917 use_ml: true
918 min_line_len: 12
919 required_substrings:
920 - cert
921 target:
922 - code
923
924- name: Jfrog Token
925 severity: high
926 confidence: strong
927 type: pattern
928 values:
929 - (?<![0-9A-Za-z_-])(?P<value>(cmVmdGtuO[0-9A-Za-z_-]{55}|AKCp[0-9A-Za-z_-]{69}))(?![0-9A-Za-z_-])
930 filter_type:
931 - ValueJfrogTokenCheck
932 required_substrings:
933 - cmVmdGtuO
934 - AKCp
935 min_line_len: 64
936 target:
937 - code
938 - doc
939
940- name: Azure Access Token
941 severity: high
942 confidence: strong
943 type: pattern
944 values:
945 - (?<![0-9A-Za-z_-])(?P<value>eyJ[0-9A-Za-z_=-]{50,500}\.eyJ[0-9A-Za-z_=-]{8,8000}\.[0-9A-Za-z_=-]{18,800})
946 filter_type:
947 - ValueAzureTokenCheck
948 required_substrings:
949 - eyJ
950 min_line_len: 148
951 target:
952 - code
953 - doc
954
955- name: Azure Secret Value
956 severity: high
957 confidence: moderate
958 type: pattern
959 values:
960 - (?<![0-9A-Za-z_-])(?P<value>[0-9A-Za-z_~.-]{3}8Q~[0-9A-Za-z_~.-]{34})(?![0-9A-Za-z_-])
961 filter_type: TokenPattern
962 min_line_len: 40
963 required_substrings:
964 - 8Q~
965 target:
966 - code
967 - doc
968
969- name: Bitbucket App Password
970 severity: high
971 confidence: strong
972 type: pattern
973 values:
974 - (?<![0-9A-Za-z_-])(?P<value>ATBB[0-9A-Za-z]{24}[A-F0-9]{8})(?![0-9A-Za-z_-])
975 filter_type:
976 - ValueAtlassianTokenCheck
977 min_line_len: 28
978 required_substrings:
979 - ATBB
980 target:
981 - code
982 - doc
983
984- name: Bitbucket Repository Access Token
985 severity: high
986 confidence: strong
987 type: pattern
988 values:
989 - (?<![0-9A-Za-z_-])(?P<value>ATCTT3xFfGN0[0-9A-Za-z_-]{80,800}(\\?=|%3[dD])[A-F0-9]{8})(?![0-9A-Za-z_-])
990 filter_type:
991 - ValueAtlassianTokenCheck
992 min_line_len: 160
993 required_substrings:
994 - ATCTT3xFfGN0
995 target:
996 - code
997 - doc
998
999- name: Bitbucket HTTP Access Token
1000 severity: high
1001 confidence: strong
1002 type: pattern
1003 values:
1004 - (?<![0-9A-Za-z_-])(?P<value>BBDC-[NMO][ADgjQTwz][0-9A-Za-z_-]{42})(?![0-9A-Za-z_-])
1005 filter_type:
1006 - ValueAtlassianTokenCheck
1007 min_line_len: 49
1008 required_substrings:
1009 - BBDC-
1010 target:
1011 - code
1012 - doc
1013
1014- name: Bitbucket Client ID
1015 severity: info
1016 confidence: weak
1017 type: pattern
1018 values:
1019 - (?<![.0-9A-Za-z_/+-])(?P<value>[0-9A-Za-z]{18}([0-9A-Za-z]{14})?)(?![0-9A-Za-z.$_/+-])
1020 filter_type: WeirdBase64Token
1021 min_line_len: 18
1022 required_regex: "[0-9A-Za-z_/+-]{15}"
1023 target:
1024 - code
1025 - doc
1026
1027- name: Bitbucket Client Secret
1028 severity: info
1029 confidence: weak
1030 type: pattern
1031 values:
1032 - (?<![.0-9A-Za-z_/+-])(?P<value>([0-9A-Za-z_-]{32}){1,2})(?![0-9A-Za-z.$_/+-])
1033 filter_type: WeirdBase64Token
1034 min_line_len: 32
1035 required_regex: "[0-9A-Za-z_/+-]{15}"
1036 target:
1037 - code
1038 - doc
1039
1040- name: Jira / Confluence PAT token
1041 severity: high
1042 confidence: strong
1043 type: pattern
1044 values:
1045 - (?<![0-9A-Za-z_-])(?P<value>[NMO][ADgjQTwz][0-9A-Za-z_-]{42})(?![0-9A-Za-z_-])
1046 filter_type:
1047 - ValueAtlassianTokenCheck
1048 - ValueBase64PartCheck
1049 min_line_len: 44
1050 required_substrings:
1051 - M
1052 - N
1053 - O
1054 required_regex: "[0-9A-Za-z_/+-]{15}"
1055 target:
1056 - code
1057 - doc
1058
1059- name: Atlassian Old PAT token
1060 severity: info
1061 confidence: weak
1062 type: pattern
1063 values:
1064 - (?<![.0-9A-Za-z_/+-])(?P<value>[0-9A-Za-z]{24})(?![=0-9A-Za-z.$_/+-])
1065 filter_type: WeirdBase64Token
1066 min_line_len: 24
1067 required_regex: "[0-9A-Za-z_/+-]{15}"
1068 target:
1069 - code
1070 - doc
1071
1072- name: Atlassian PAT token
1073 severity: high
1074 confidence: strong
1075 type: pattern
1076 values:
1077 - (?<![0-9A-Za-z_-])(?P<value>ATATT3xFfGF0[0-9A-Za-z_-]{80,800}(\\?=|%3[dD])[A-F0-9]{8})(?![0-9A-Za-z_-])
1078 filter_type:
1079 - ValueAtlassianTokenCheck
1080 min_line_len: 160
1081 required_substrings:
1082 - ATATT3xFfGF0
1083 target:
1084 - code
1085 - doc
1086
1087- name: Digital Ocean Token
1088 severity: high
1089 confidence: strong
1090 type: pattern
1091 values:
1092 - (?<![0-9A-Za-z_-])(?P<value>do[op]_v1_[a-f0-9]{64})(?![0-9A-Za-z_-])
1093 filter_type: TokenPattern
1094 min_line_len: 71
1095 required_substrings:
1096 - doo_v1_
1097 - dop_v1_
1098 target:
1099 - code
1100 - doc
1101
1102- name: Dropbox OAuth2 API Access Token
1103 severity: high
1104 confidence: moderate
1105 type: pattern
1106 values:
1107 - (?<![0-9A-Za-z_-])(?P<value>sl.[0-9A-Za-z_-]{135})(?![0-9A-Za-z_-])
1108 filter_type: TokenPattern
1109 min_line_len: 138
1110 required_substrings:
1111 - sl.
1112 target:
1113 - code
1114 - doc
1115
1116- name: NuGet API key
1117 severity: high
1118 confidence: moderate
1119 type: pattern
1120 values:
1121 - (?<![0-9A-Za-z_-])(?P<value>oy2[a-z0-9]{43})(?![0-9A-Za-z_-])
1122 filter_type: TokenPattern
1123 min_line_len: 46
1124 required_substrings:
1125 - oy2
1126 target:
1127 - code
1128 - doc
1129
1130- name: Gitlab Prefix Token
1131 severity: high
1132 confidence: strong
1133 type: pattern
1134 values:
1135 - (?<![0-9A-Za-z_-])(?P<value>(_gitlab_session=|GR1348941|gl(agent|soat|ffct|p[at]t|oas|cbt|imt|[dfr]t)-)[0-9A-Za-z_-]{20,64})(?![0-9A-Za-z_-])
1136 filter_type:
1137 - ValuePatternCheck
1138 min_line_len: 25
1139 required_substrings:
1140 - _gitlab_session=
1141 - GR1348941
1142 - glagent-
1143 - glsoat-
1144 - glffct-
1145 - glpat-
1146 - gloas-
1147 - glptt-
1148 - glcbt-
1149 - glimt-
1150 - gldt-
1151 - glft-
1152 - glrt-
1153 target:
1154 - code
1155 - doc
1156
1157- name: Grafana Provisioned API Key
1158 severity: high
1159 confidence: strong
1160 type: pattern
1161 values:
1162 - (?<![0-9A-Za-z_-])(?P<value>eyJ[=0-9A-Za-z_-]{64,360})(?![0-9A-Za-z_-])
1163 filter_type:
1164 - ValueGrafanaCheck
1165 min_line_len: 67
1166 required_substrings:
1167 - eyJ
1168 target:
1169 - code
1170 - doc
1171
1172- name: Grafana Access Policy Token
1173 severity: high
1174 confidence: strong
1175 type: pattern
1176 values:
1177 - (?<![0-9A-Za-z_-])(?P<value>glc_eyJ[0-9A-Za-z_-]{80,360})(?![0-9A-Za-z_-])
1178 filter_type:
1179 - ValueGrafanaCheck
1180 min_line_len: 87
1181 required_substrings:
1182 - glc_eyJ
1183 target:
1184 - code
1185 - doc
1186
1187- name: Grafana Service Account Token
1188 severity: high
1189 confidence: strong
1190 type: pattern
1191 values:
1192 - (?<![0-9A-Za-z_-])(?P<value>glsa_[0-9A-Za-z_-]{32}_[0-9A-Fa-f]{8})(?![0-9A-Za-z_-])
1193 min_line_len: 46
1194 filter_type:
1195 - ValueGrafanaServiceCheck
1196 required_substrings:
1197 - glsa_
1198 target:
1199 - code
1200 - doc
1201
1202- name: Dropbox API secret (long term)
1203 severity: high
1204 confidence: weak
1205 type: pattern
1206 values:
1207 - (?<![0-9A-Za-z_-])(?=[0-9A-Za-z]{64})(?P<value>[0-9A-Za-z]{10,12}[B-Za-z0-9]A{10,12}[B-Za-z0-9][0-9A-Za-z]{40,44})(?![=0-9A-Za-z_-])
1208 filter_type: []
1209 min_line_len: 43
1210 required_substrings:
1211 - AAAAAAAAAA
1212 target:
1213 - code
1214 - doc
1215
1216- name: Dropbox App secret
1217 severity: info
1218 confidence: weak
1219 type: pattern
1220 values:
1221 - (?<![.0-9A-Za-z_/+-])(?P<value>[a-z0-9]{15})(?![=0-9A-Za-z_/+-])
1222 filter_type: WeirdBase36Token
1223 min_line_len: 15
1224 required_regex: "[0-9A-Za-z_/+-]{15}"
1225 target:
1226 - code
1227 - doc
1228
1229- name: Gitlab Incoming Email Token
1230 severity: info
1231 confidence: weak
1232 type: pattern
1233 values:
1234 - (?<![.0-9A-Za-z_/+-])(?P<value>[a-z0-9]{24,25})(?![=0-9A-Za-z_/+-])
1235 filter_type: WeirdBase36Token
1236 min_line_len: 24
1237 required_regex: "[0-9A-Za-z_/+-]{15}"
1238 target:
1239 - code
1240 - doc
1241
1242- name: Gitlab Feed Token
1243 severity: info
1244 confidence: weak
1245 type: pattern
1246 values:
1247 - (?<![.0-9A-Za-z_/+-])(?P<value>[0-9A-Za-z_-]{20})(?![=0-9A-Za-z_/+-])
1248 filter_type: WeirdBase64Token
1249 min_line_len: 20
1250 required_regex: "[0-9A-Za-z_/+-]{15}"
1251 target:
1252 - code
1253 - doc
1254
1255- name: Hashicorp Vault Token
1256 severity: high
1257 confidence: strong
1258 type: pattern
1259 values:
1260 - (?<![.0-9A-Za-z_-])(?P<value>hv[brs]\.[0-9A-Za-z_-]{80,160})
1261 filter_type:
1262 - ValuePatternCheck
1263 - ValueEntropyBase64Check
1264 min_line_len: 90
1265 required_substring:
1266 - hvb.
1267 - hvr.
1268 - hvs.
1269 target:
1270 - code
1271 - doc
1272
1273- name: Hashicorp Terraform Token
1274 severity: high
1275 confidence: strong
1276 type: pattern
1277 values:
1278 - (?<![.0-9A-Za-z_-])(?P<value>[0-9A-Za-z_-]{14}\.atlasv1\.[0-9A-Za-z_-]{67})(?![0-9A-Za-z_-])
1279 filter_type:
1280 - ValuePatternCheck
1281 - ValueEntropyBase64Check
1282 min_line_len: 90
1283 required_substring:
1284 - .atlasv1.
1285 target:
1286 - code
1287 - doc
1288
1289- name: Jira 2FA
1290 severity: info
1291 confidence: weak
1292 type: pattern
1293 values:
1294 - (?<![.0-9A-Za-z_/+-])(?P<value>[A-Z2-7]{16})(?![=0-9A-Za-z_/+-])
1295 filter_type:
1296 - ValueCoupleKeywordCheck
1297 - ValuePatternCheck
1298 - ValueEntropyBase32Check
1299 - ValueBase32DataCheck
1300 - ValueTokenBase32Check
1301 min_line_len: 16
1302 required_regex: "[0-9A-Za-z_/+-]{15}"
1303 target:
1304 - code
1305 - doc
1306
1307- name: OpenAI Token
1308 severity: high
1309 confidence: strong
1310 type: pattern
1311 values:
1312 - (?<![.0-9A-Za-z_-])(?P<value>sk-[0-9A-Za-z_-]{16,32}(T3BlbkFJ|9wZW5BS|PcGVuQU)[0-9A-Za-z_-]{16,32})(?![0-9A-Za-z_-])
1313 min_line_len: 51
1314 filter_type:
1315 - ValuePatternCheck
1316 - ValueEntropyBase64Check
1317 required_substrings:
1318 - T3BlbkFJ
1319 - 9wZW5BS
1320 - PcGVuQU
1321 target:
1322 - code
1323 - doc
1324
1325- name: Docker Swarm Token
1326 severity: high
1327 confidence: strong
1328 type: pattern
1329 values:
1330 - (?<![.0-9A-Za-z_-])(?P<value>SWMTKN-1-[0-9a-z]{50}-[0-9a-z]{25})(?![0-9A-Za-z_-])
1331 min_line_len: 85
1332 filter_type:
1333 - ValueCoupleKeywordCheck
1334 required_substrings:
1335 - SWMTKN-1-
1336 target:
1337 - code
1338 - doc
1339
1340- name: Groq API Key
1341 severity: high
1342 confidence: strong
1343 type: pattern
1344 values:
1345 - (?<![0-9A-Za-z_-])(?P<value>gsk_[0-9A-Za-z_-]{52})(?![0-9A-Za-z_-])
1346 min_line_len: 56
1347 filter_type:
1348 - ValuePatternCheck
1349 - ValueEntropyBase64Check
1350 required_substrings:
1351 - gsk_
1352 target:
1353 - code
1354 - doc
1355
1356- name: Hugging Face User Access Token
1357 severity: high
1358 confidence: moderate
1359 type: pattern
1360 values:
1361 - (?<![0-9A-Za-z_-])(?P<value>hf_[0-9A-Za-z_-]{34})(?![0-9A-Za-z_-])
1362 min_line_len: 37
1363 filter_type:
1364 - ValuePatternCheck
1365 - ValueEntropyBase64Check
1366 required_substrings:
1367 - hf_
1368 target:
1369 - code
1370 - doc
1371
1372- name: Discord Bot Token
1373 severity: high
1374 confidence: strong
1375 type: pattern
1376 values:
1377 - (?<![0-9A-Za-z_-])(?P<value>[NMO][ADgjQTwz][0-9A-Za-z_-]{22,26}\.[0-9A-Za-z_-]{6}\.[0-9A-Za-z_-]{30,40})(?![0-9A-Za-z_-])
1378 min_line_len: 62
1379 filter_type:
1380 - ValueDiscordBotCheck
1381 required_substrings:
1382 - M
1383 - N
1384 - O
1385 required_regex: "[0-9A-Za-z_/+-]{15}"
1386 target:
1387 - code
1388 - doc
1389
1390- name: Tencent WeChat API App ID
1391 severity: medium
1392 confidence: weak
1393 type: pattern
1394 values:
1395 - (?<![0-9A-Za-z_-])(?P<value>wx[0-9a-f]{16})(?![0-9A-Za-z_-])
1396 min_line_len: 18
1397 filter_type: TokenPattern
1398 required_substrings:
1399 - wx
1400 target:
1401 - code
1402 - doc