Hot answers tagged

3 votes

How can I write logical signature for ClamAV simillar as it is in YARA?

Done. I was a little bit lazy to research deeper on my own, but here is an answer: Logical Expression This is where we will insert our boolean logic for detecting on our content matches. ...
Mirsad's user avatar
  • 10.2k
2 votes

How long is a typical malware signature?

What antivirus vendors mean when they use the term signature is not digital signature/hash/checksum. A malware signature here is really best described as a short program written in a domain specific ...
Lie Ryan's user avatar
  • 31.4k
1 vote

Yara condition count operator with wildcard

Your rule condition will match if at least 3 of the string found, not the count of all the string found. Because Yara doesn't mix the wildcard identifier(*) with counts(#), you can only use regex to ...
mootmoot's user avatar
  • 2,407
1 vote

Scanning a binary against YARA rules dictionary

YARA allows you to specify multiple rules files to be used (as the latest version). yara64.exe path/rule/file1 path/rule/file2 path/rule/file3 malwareFile I don't know what the limit to the number ...
Daisetsu's user avatar
  • 5,100
1 vote

How do I use a directory of YARA files?

There are two primary ways to scan for the IoCs in Yara files: Against files on disk using a tool such as Loki.exe. Loki requires yara and will scan Windows machines looking for IoCs. Versus memory ...
atdre's user avatar
  • 19k

Only top scored, non community-wiki answers of a minimum length are eligible