Is it possible to use it for non-yara scenarios #357

Hi @phutelmyer ,

For financial data, the crown jewels are the Primary Account Number (PAN) records. Just like PII, especially identity numbers, they are also in specific formats depending on the provider. For instance, the PAN of cards for the top 3 brands can be detected by these regex patterns:

Mastercard: (?:\D|^)(5[1-5][0-9]{2}(?:\ |\-|)[0-9]{4}(?:\ |\-|)[0-9]{4}(?:\ |\-|)[0-9]{4})(?:\D|$)')
Visa:       (?:\D|^)(4[0-9]{3}(?:\ |\-|)[0-9]{4}(?:\ |\-|)[0-9]{4}(?:\ |\-|)[0-9]{4})(?:\D|$)')
AMEX:       (?:\D|^)((?:34|37)[0-9]{2}(?:\ |\-|)[0-9]{6}(?:\ |\-|)[0-9]{5})(?:\D|$)

But it is not enough as there is an algorithm behind the card numbers, called Luhn. We can test it with a simple Python method:

def is_valid_luhn_checksum(pan: str) -> bool:
        """ from wikipedia: https://en.wikipedia.org/wiki/Luhn_algorithm"""

        safe_pan: str = re.sub(r'[^\d]', '', pan)

        def digits_of(n) -> list[int]:
            return [int(d) for d in str(n)]

        digits: list[int] = digits_of(safe_pan)
        odd_digits: list[int] = digits[-1::-2]
        even_digits: list[int] = digits[-2::-2]
        checksum: int = 0
        checksum += sum(odd_digits)
        for d in even_digits:
            checksum += sum(digits_of(d * 2))

        return checksum % 10 == 0

The issue is that I can solve the first step with yara using regex but not the second step. I believe it is doable but I wanted to learn what is the supported way instead of hacking my way out of this.

As you see, this is not a case for malware scanning but critical information scanning on filesystem. Therefore, if strelka does not support it or plan to support it, that's something I would like to know, so that I can try other ways.

I should have checked the code. It looks like it is already supported. Thanks.