Automatic license key removal for rule 5 enforcement

[tigattack]

In GitLab by @alyxw on Apr 17, 2020, 13:16

Overview

An extension to match message contents against known formats of license keys (Windows, VMware, etc) to automatically enforce rule 5.

Commands

n/a

DoD

• compile expressions to match for common software
• build something to automatically act upon matches

Stretch

• a whitelist for KMS keys because those come up in legitimate conversation sometimes, apparently

[tigattack]

In GitLab by @issy on Jul 7, 2020, 19:00

regex for windows license keys (AFAIK)
.*[A-Z0-9]{5}-[A-Z0-9]{5}-[A-Z0-9]{5}-[A-Z0-9]{5}-[A-Z0-9]{5}.*
unsure of whether there are any definitive differences in the construction of KMS keys

[tigattack]

In GitLab by @tigattack on Jul 8, 2020, 15:11

That'd work for KMS keys too. Nice one Issy.

[themiddlegeek]

Tested against various VMware keys, caught every single one.