4

First of all, I know that yara rules can be used in combination with ClamAV, but here I have something else in my mind, so my question is; how can I write logical signature simillar as it is in YARA.

Here is an example; Let's say that I have three strings:

A, B and C

convert that in YARA rule:

strings:

$s1 = "A"
$s2 = "B"
$s3 = "C"

condition:

any of them

Any idea how can I achieve that with ClamAV signatures?

3

Done. I was a little bit lazy to research deeper on my own, but here is an answer:

Logical Expression

This is where we will insert our boolean logic for detecting on our content matches. This uses operands like "&" for "and", "|" for "or", as well as "=", "<", ">".

So strings will be separated like:

(0|1|2);3c3f7068702024;68647337386870;6576616c

Simple as that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.