3
votes
Accepted
How can I write logical signature for ClamAV simillar as it is in YARA?
Done. I was a little bit lazy to research deeper on my own, but here is an answer:
Logical Expression
This is where we will insert our boolean logic for detecting on our
content matches. ...
- 10.2k
2
votes
How long is a typical malware signature?
What antivirus vendors mean when they use the term signature is not digital signature/hash/checksum. A malware signature here is really best described as a short program written in a domain specific ...
- 31.4k
1
vote
Accepted
Yara condition count operator with wildcard
Your rule condition will match if at least 3 of the string found, not the count of all the string found. Because Yara doesn't mix the wildcard identifier(*) with counts(#), you can only use regex to ...
- 2,407
1
vote
Scanning a binary against YARA rules dictionary
YARA allows you to specify multiple rules files to be used (as the latest version).
yara64.exe path/rule/file1 path/rule/file2 path/rule/file3 malwareFile
I don't know what the limit to the number ...
- 5,100
1
vote
How do I use a directory of YARA files?
There are two primary ways to scan for the IoCs in Yara files:
Against files on disk using a tool such as Loki.exe. Loki requires yara and will scan Windows machines looking for IoCs.
Versus memory ...
- 19k
Only top scored, non community-wiki answers of a minimum length are eligible