##################################################################

# *** OneRuleToRuleThemStill *** #

# #

# An optimised revamp of OneRuleToRuleThemAll #

# #

# ~5% rules reduction with 0% performance loss #

# against Lifeboat and LastFM data breaches #

# #

# Updates: #

# - De-duplication of resulting candidate generation #

# (previously literal strings only) #

# - Added LastFM breach dataset (~21m unique hashes) #

# - Common non-matching rules removed (Lifeboat and LastFM) #

# - Ordered by frequency against LastFM #

# #

# Blog: https://in.security/2023/01/10/ #

# oneruletorulethemstill-new-and-improved/ #

# #

# Discord: https://discord.gg/5VpwE9YJ9R #

# Twitter: @Stealthsploit #

# Mastodon: @Stealthsploit@infosec.exchange #

# Web: https://in.security #

# #

# *** v1.1 10/01/23 *** #

##################################################################

:

,7]

,8$9

,6$1

,7-4

,7+6

,8-7

,6*45

,7$0

,6D3

,6Es]v

,9+5{

,6*30

,6$1$2$3

,7,8

,6Z1

.6$2

,6$8

,6u

,6o1o

,8i6s

Z1cD7

,7+6Y2

,5o41

,5,6,7

.6c

Y5'8

,4K

,7E$3

,2,1*02

.6-9-5

,2,6

Y4x26

suo$1

.8s26

,3+3

,3.5

,5k

ss7$7

,7.5

,2*01

T7$1

,5*52

,8

Z4'7}

.7o64

.6*56+2

$Vc'9

.6i63

,5-2

,4*30

.6+4

Z1o75

.6+7

,4}

,6,7

ss5$3

,3r

.6K[

.3$J'4y4

so0si1

ss5si1se3

,6$e

ss5$6

ss5$4

ss5se3so0

.7o1e*02

,3o4i

Z2'8u

.4+5

ss1$2$3

,3*02

,5i54

,1-0

,4k

Z3*58'8

ss9$8

,4*53

.5-3

,3o4a

[T8+7

.7]-7

Z1-8

,1+0

$!T0

,3o4e

,5i5s

,3o4y

,3*12

,3E

,4,5,6

,9

,2+1

ssz$2

usSZ

.4-5

,5z1

sue-0

ss1$0$1

,6*76

,4+5

Z5*75'5i01{

,4+1

ss5$5

,4]

,5$1

Z1p2'A

T0TA

,5*56

,5o0d

Y1*6B'9

Z1+7

,5]

@uo53

$s@y

Z1ssz

@t^c

,3$1

ss0$0$7

@u+2[

skoK

,4o6t

.4p2'A

ss7$8$9

T6o0f

so0$!

.6c]

.6

ss9$0

,7,5

,3o4o

@y^i

ss3$2$1

^t^s^a^l

,3$7sU;

Z2s27

s26}

,4$1

,1,5r

,4Z1

,1,5

spu^j

.3+4

Z1o55

.4$7

,7stG+8

T8o70

.4}

,3$5p4

,1,2

.3-3D1

.7+9

,4$2

smyD2

,4o51

,1{

.7o4rK

,4*04.1

.1+2

,3.4

^-s-m

,1,4

Z1o80T0

,6-2.1

so0$1$2$3

,2sw2{

T0,8$7

,1,3

Z1o52

Y2*72'4

,2,5

,6]

.4[

Z1$7

$z@s

,3,4

T6o56

.4*43

slp+7

,3o2k

.3k*23

Z1o59

,3$3

ss7$7$7

Z1s12

ssOD2D2

.2+3

s14$4

,2,3

,3$8

,3*52

,3D4

l$6$9

,3,4,5

siy$7

so0sa4

skg+0

,6i6d

,1+3*12

.2*20

,2,4

sour

Z1-6[

Y1+6oAl

.1k

Z1D3+5

Z2*79o70

,3}

T7T0

stm+A

Y3x35

@uo3c

.4]

}z1

.3*45

,6

ss1$0$0

[^w

.1*32

,2T0

so0se3si1

T0d

ss3$4$5

,3$4

ss5sa4sl7si|so0

,3^s

,3$s

,6o71

Z1o85c

,3$2

l^1

Z1o54

.5i5e

,3$1$2

Z1o5k

std*B5

skro0dK

.7o4j

sq+o2bsD&

.6o4p

syi

^y^m

Y4'8

slr+9

so0E

rD2r

Z1o6t

,1,3,5

srn*20

soa$8

,1,2D4

Z2p5+7

y3'6

[Z1+5

,3+0

,5i5b

,6*46

s18

ss5sa@se3si1so0

so0$2

sHWseos25

Z1+7D4

s)2Z1}

,4o5a

T7i6.

T6o2m

slf*12[

.5.4

z1o0a}

y2{{

,1,4r

s&$o2k

sck

.6Y1*20

,3Z3D3

@vo5g

,1*41

,5o61

,2$1

Y2o72

l$8$6

,3$1$1

,3D5

ss9$9$9

ss5$1

l$8$7

,2$7

,7

Y1s19TB

,1D2

suek

Y5k'8

soa

p1

stmi3e

usOE

ss1$2$3$4

K}}

smdo1a

,3o2f

se3$3

.5i3a-6

T6T0

.7E$3

se3sa4

T0$9

.7o0H

s>C+6K

.4k+0

[^v

Z1sou

,4*36

,2$5

s19

,3o1e

,1i1i

y2smv[

Z1i80

sao

,3[{

$yoB7-7

y3D6-B

s25-6

,4$1$2

Y4o9s'A

Z1-6+4

s17oA&

z1i1a

,3o1a

,3D1

.2*10*21

saescg

siy$5

,4o5y

,3o5a

,3E$2

,3$1$0

,2$2

,3$1$3

$f$m

ss9$9

srl

}T1-0

,4o5i

u$a

R8o0a

,4o3w

z2o1o

y2o0m

.5D3

ss5$5$5

saeD6

sx,sszo9M

l$8$2

]$t

,2$4

.4r

T7o49

,3$2$1

stl

.2*21

,3]

.3D2

l^3^2^1

s16

l$8$5

T5o48

ssl

ssb

^To0sD5

l$9$2

T0i82

ur

s27

,4i4a

^to1r

$2$0$1$0

.2-5*20

si1o60

.4Z1*57

,2r

Z1i81

T5D4

]suo

T0o68

.4*56

,3o4u

sea

,5l

Z2+8

$r'9

Z1o5c

,3+4

Z1i74

Z2o76

l$9$3

@t

s?Zi4k

siy

.3D6

Y1-7$3

,3$0$0

,3c$4

sei

z1}k

s'ic+7

syCT7ssg

Y1-5

.2[

s$vli6n

,1E*15

.2*52

,1r

$u$s

l$7$9

,2k*30

so0sa@

,2D3

@t+3o2t

ss-$m$a$n

l$8$3

s29

Y1-5-5

T0T8T4

o92$6

srwo2u

,2D4

s28*23

R7o0Ml

.2$0$1

l$9$1

,2i2c

Y2o78

,4

,1,3.4

Z1i71

,2-3

,3d'A

l$9$4

,4i4k

soa[

^r^m

soisy%

,3i4e

,2+3

^x^e^l^a

}}}}c

sau$3

z1-2-1

,3$2$2

so0$1

Z1t-6

Z1o7i

[srv

Z2s19

@yi4-

Z1o6p

^to1ho2e

,3$1$2$3

,2$3

sai

l$8$4

l$7$6

T0T3T8

,3i4a

Z1i79

s85+9

soe

sl1

]]$y

,2$8

y5DA

[z2+1

Z1$2

,1,2,4

i01i19

l$9$6

si1c

Z3}}

,3i4y

Z2-6

sou'8

T0$1$1

.5

ssz+3

y5'8

sye

Z1*35

l$0$8

T2T0

,2}

l$9$5

,5i61i72o83

z1+3*12

ssf[*35

$y@n

.5o6o

z1D5*13

z1*31

Z1u+6

.5o4h

st6+4*45

l$!

]T0D7

ss4$m$e

Z1*25D3

Z1$5

T1T0

l$9$0

Z2o67

^uk*6A

T0r

,3$7$7

]y4

o77o0d

]]]Z1

^x^a^m

sio

Z1s26p5

l$8$1

sua

stp

z1

.2$0$9

si1o50

^r^e^p^u^s

T5o40

l$7$5

y4D7D7

s15

sae-2

Z1D3

.5$2

y3KD6

s14-7

^u^l

Y1+5*64

Z1i69

z1*06

sgo+2

se3$1$2$3

R2D2^b

,4,5

Z2+6

T6o3fs4b

p4$a

}}}}}}Y4'4d

.5*45

$6Z2

^so1t

ss1$9$8$4

$2$0$0$9

s18Z1

.2o0f

l$6$6

i01i12

,2$1$2

siu

ssc]

,2D5

stRl

[T0

.3D5

.2o0g

s24

l$7$8

,3$9$9

,1,2,5

l$4$2

ss1$9$8$6

^o^g

,1K

.1i2m

so0se3

.4c

^e^v^o^l^i

l$7$4

,2y2*45

l$9$7

^y^b^a^b

$Wl

ssjKi0b

usL1

l$8$0

,3*30k

$u@k

Z2+7+5

,3$0$2

p3^a

s08$3

Y2D7K

ss2$0$0$1

.3i48

}x14

.2o1i

s08

s14o1o

Y2o74

ss1$9$8$5

,3$0$5

Z2o68

s25K

@ssix

l$7$2

Z2-5

Y3o94]

]$y

t$6

sdk*74+5

T0^7

s_c$0$0

T6i47

Y1$4

.4+7

l$7$3

Z1*60{

Y1$8

Z2T0-7

,7i7u

Y2D7

$yo5t

$Tl

ss1$9$8$2

l$2$6

^y^mT2

l$8$8

^so1ho2a

,6o1x

.4t

ssn

Y1$6

Z2+5

,2'7

^to1h

$s$1

[^vD1

o60^a

T0D8D5

$x@c

Y2o79

Z1snl

}z2c

,5,6

sS1$9$8$0

y4Z4'8

,2o3k

.4Ky2

siy$2

l$2$7

T7T6T5

z1*03

@r-7D3

ss1$9$8$1

p4o2no1a

{snm[

,3$0$3

.2$2$3

s17*34

Z2+7o50

Z1o0k

i02

,2+4

^tsmt*21

T0std

ss2$0$1$2

sa4so0si1

l$4$7

z1*31*34

i04

T4+3

}x04

.4k

,2$0$1

T0T5

Y2slp

s07^5sS'

,1-2

Z1+7o0a

ss1$2$3$4$5

.2$8$8

Y1+5

o7.

.4$8

,2*34

z1i1i

y2o0d

ss1$9$8$3

Y1i90-8

,1+2

.3i4m

T8sdn

syj

smhD6*31

szs

Z1i62

,2o3p

.4k.3

$m$u$s$i$c

l$6$5

^to1hi2e

l$5$6

^so1p

}rl

soEo68[

x14

$zD4

^Zl

y1.9*21

Z1o0b

s36

l$5$7

se7i65

s1k

T0i86

saeD2

Z1o4a

$xD6

.4*68*57

z1l*16

^to1o

p5i6i

Z3o70+6

$xD5

r'6

^u^m

$!Z1

,2^b

Z1+9i85

Z1$1

l$2$8

,1-3

.3r

sg5kr

p4x5A'6

,1D3

Z1*50

Y1$3

o76o89

T4o0s

s16-5

,1E

s07

o78o87

,3$a

l$1$8

,2Y1

]]]$y

o66$9

ss2$0$0$8

l$9$8

,1D4

l$5$9

l$3$1

z2o1u

Z1$a

y2o0k

ss1$9$7$9

,2i53

saor

T4{{

i0ti1hi2e

o72o61

Z1T0$9

,2$1$1

l$1$6

sep*12

Z1o43l

^Rl

,4*06

R1o01

l$7$1

Z1i64

,2*62r

,1+3

s35

t-8$5

,2$9

,4i4p

s79

l$6$8

o90$7

sdx*53s4]

stzo4z

s10i83

ss2$0$0$0

l$2$5

ss1$9$9$0

T0i89

^w^e^n

ss1$9$7$4

[^W

$2$0$1$1

o8.

l$6$7

Y2KD5

si1TA

ss-$b$o$y

i9.

,1$1

z2*40+1

Z1c

l$2$9

Y2o53

T5o0M

so0o41

ss1$9$7$8

smo*45-3

,2$1$0

s32+5

^uD5}

$t$o

s09

,2i04

l$1$7

Z1o44slF

$*

]Z2

$s$t

^u^j

]spb

^y^m]

.4{r

.2$9$0

ss1$9$7$5

sau*57

Z1o49

Y2*89+6

l$1$9

o71o89

.2$9

Z2*50[

sld

,2$1$3

ss1$9$8$9

s18*40

l$3$7

[p4'8

ss1$9$7$6

s14

}z1}

,2i2z

usI1$1

sgeo4n

u$m

T0-7+5

s13K

Z1$9

rk

[Z1,5

p5i44]

o9i$e

Y2o62

smg

l$5$8

^so1l

l$2$0$0$7

s13Z1

,4i51i62o73

l$8$9

srh*27

Y1[+4

l$6$4

ssf

Z1o7p

T0T1T2

ss1$9$9$2

T0*58*56

ss1$9$7$2

l$0$6

s15-2

so0]

Y2o55

s93

}}y2

s46

^v^u^l^i

seu*02

l$4$0

s1-swf

l$3$6

^t^o^h

smk

sa@$1$2$3

s8D^d-6

$o$n$e

y2o0j

T3sbP

sS1$9$8$8

]$z

,1-4

ss0$9

s06

Z1$y

[y5c

sS1i12i23

usE3+1

z1K

^zD3

$t$e

Z2s18

srssaj

ss1$9$9$1

s)ai2d

s75

s1is0o

,3$4$4

sym

^Pls.y

s58

T1o01

l$6$2

y2o2t

.5.2

ss1$9$7$1

l$3$0

T4*53r

l$5$0

,2z1

tT3T1

^to1i

tsOA

Z1,8

^so1ho2i

^zD2

sioK

,2sC+t

Y1-0+5

,5$1$2$3

r]K

saso1k

^r^a^m

stp]

$y$a

l$2$0$1$2

Z1i63

ssni59

^t^a^c

y3D5

l$3$4

o6io0c

y2o0s

s69

Z1o0l

^r^d

skc

seu

R0{^k

]Y3]

Y2o84

.4Y1

l$2$0

l$5$2

.4o68

l$6$3

Z1i56

R6L6o55

si!se3

T4sau

,4$1$2$3

z1^a

$z-5

.2^c

uo62o7K$6

l$4$8

tD2

Y2o59

,2$a

Z1z1

i8.

o76o62

Y2o56

l$5$1

^yk

Z1E$5

ss$