Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support for inline Yara rules in addition to .yar files #36

Open
ITAYC0HEN opened this issue Aug 13, 2020 · 0 comments
Open

Support for inline Yara rules in addition to .yar files #36

ITAYC0HEN opened this issue Aug 13, 2020 · 0 comments
Labels
enhancement New feature or request

Comments

@ITAYC0HEN
Copy link
Contributor

What do you think of adding support for inline Yara rules for the Extractor / ExtractorManager? Currently I think that it only supports yara files stated in yara_rules = [...]. I think it can be nice to also be able to provide yara rules as a string so this can be matched against as well.

rules = '''
rule Dridex 
{
    meta:
     ...
     ...
}

rule Gozi
{
   strings:
     ....
}
'''

I personally prefer to use Yara files (.yar ) and not inline rules, but I think it can be nice extension

@nazywam nazywam added the enhancement New feature or request label May 24, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants