Yara condition count operator with wildcard [closed]

Question

I have a yara rule that looks for multiple strings in a file and fires if the count is greater than 3. But how would I change the condition statement to only fire if greater than 3 but less than 5?

Essentially I want something like this

3 < (#var_*) < 10

But this statement is not valid syntax. Is there a way to use the count operator # with a wildcard *?

rule strings
{
    meta:
        notes = "testing"
    strings:
        var_01 = "string1"
        var_02 = "string2"
        var_03 = "string3"
        var_04 = "string4"
        var_05 = "string5"
        var_06 = "string6"
        var_07 = "string7"
        var_08 = "string8"
    condition:
        3 of ($var_*)
}

Answer 1

Your rule condition will match if at least 3 of the string found, not the count of all the string found. Because Yara doesn't mix the wildcard identifier(*) with counts(#), you can only use regex to simplified the count.

rule countstr
{
    strings:
        $a1 = /(string1|string2|string3|string4|string5|string6|string7|string8)/
    condition:
        #a1 > 3 and #a1 < 10
}

Bear in mind that regex cannot compete with plain string matching. For performance concern, you need to resort to something like the following.

rule countstr2
{
    strings:
        $a1 = "string1"
        $a2 = "string2"
        $a3 = "string3"
        $a4 = "string4"
        $a5 = "string5"
        $a6 = "string6"
        $a7 = "string7"
        $a8 = "string8"
    condition:
        (#a1+#a2+#a3+#a4+#a5+#a6+#a7+#a8) > 3 and (#a1+#a2+#a3+#a4+#a5+#a6+#a7+#a8) < 10
}