Skip to main content

string_analyze/rules/core/
cloudkey.rs

1use crate::rules::lazy_rule;
2
3// 云凭证
4lazy_rule!(
5    RE_AWS_AK = r#"(?i)\bAKIA[0-9A-Z]{16}\b"#,
6    "发现 AWS Access Key",
7    95
8);
9lazy_rule!(
10    RE_RSA_KEY = r#"-----BEGIN (?:RSA )?PRIVATE KEY-----"#,
11    "发现 RSA 私钥",
12    95
13);
14lazy_rule!(
15    RE_SSH_KEY = r#"ssh-(?:rsa|ed25519|dss) [A-Za-z0-9+/=]{100,}"#,
16    "发现 SSH 密钥",
17    95
18);
19lazy_rule!(
20    RE_PGP = r#"-----BEGIN PGP (?:PUBLIC|PRIVATE) KEY BLOCK-----"#,
21    "发现 PGP 密钥",
22    95
23);
24lazy_rule!(
25    RE_AZURE_ACCESS_KEY =
26        r#"(?i)DefaultEndpointsProtocol=https;AccountName=[a-z0-9]+;AccountKey=[A-Za-z0-9+/=]{88}"#,
27    "发现 Azure 存储账户密钥",
28    95
29);
30lazy_rule!(
31    RE_GCP_SERVICE_ACCOUNT = r#"\{"type":\s*"service_account"[^}]{100,}\}"#,
32    "发现 GCP 服务账户凭证",
33    95
34);
35lazy_rule!(
36    RE_GCP_OAUTH = r#"ya29\.[0-9A-Za-z\-_]+"#,
37    "发现 GCP OAuth Token",
38    95
39);
40lazy_rule!(
41    RE_ALIYUN_AK = r#"(?i)LTAI[A-Za-z0-9]{12,20}"#,
42    "发现 阿里云 Access Key",
43    95
44);
45lazy_rule!(
46    RE_TENCENT_AK = r#"\bAKID[A-Za-z0-9]{13,40}\b"#,
47    "发现 腾讯云 Access Key",
48    95
49);