5 ms·
YARA – A pattern-matching Swiss knife for malware researchers
- vuln 7y agoLove me some Yara. It’s totally the best.
- xvilka 7y agoNote, that it can be integrated with radare2[1], the reverse engineering framework and toolset. The integration will allow you to apply and generate YARA signatures from within. There are two plugins - to use radare2 from Yara[2], and Yara from radare2[3]. The second one you can install using the embedded r2 package manager: `r2pm -i yara` [1] https://github.com/radareorg/radare2 https://github.com/radareorg/radare2 [2] https://r2yara.readthedocs.io/en/latest/ https://r2yara.readthedocs.io/en/latest/ [3] https://github.com/radareorg/radare2-extras/tree/master/yara https://github.com/radareorg/radare2-extras/tree/master/yara
- pwelch 7y agoYara is an awesome tool
- bane 7y agoYARA is amazing, anybody have some good collections of rules?
- ahje 7y ago"site:github.com filetype:yar" usually yields a few good ones. It's probably easier if you're more specific as to which specific use case you have in mind. And yes, Yara is a godsend. :)
- saagarjha 7y agoFun fact: XProtect on macOS uses YARA to match known malicious software. The database is at /System/Library/CoreServices/XProtect.bundle/Contents/Resources/XProtect.yara if you'd like to look at it yourself.
- campfireveteran 7y agoYep. And YARA lives at /System/Library/PrivateFrameworks/yara.framework I had a problem a few years ago with YARA consuming all CPU time while on battery and never finishing whatever it was doing.
- pmoriarty 7y agoYARA reminds me of the venerable "file" utility, and I wonder if YARA could be used in place of it to identify non-malware files that "file" has trouble identifying.
- Pete_D 7y agoThe syntax isn't as nice as YARA's, but you can extend file's capabilities if you need by writing a custom magic file - see 'man 5 magic'.
- campfireveteran 7y agoOn macOS, see also: /System/Library/PrivateFrameworks/yara.framework man yara PS: I wish VirusTotal had a high-rate, free API that could used as the basis for local endpoint scanners.
- jmpman 7y agoHow well do these tools work against code built using obfuscating compilers?
- henrygrew 7y agoYARA - Yet Another Regex App