Look at YARA-X for Velociraptor YARA engine

[mgreen27-r7]

Working with yara-x today, its a much easier experience writing rules with error notifications and as there is a go specific library it might be worth us considering using it in Velociraptor as it matures. The api would need a refactor, however future effort of updating new versions would be much easier.

https://github.com/VirusTotal/yara-x
https://virustotal.github.io/yara-x/docs/intro/getting-started/

[scudette]

Unfortunately yara x is written in rust so we can not use it directly. It would make our hermetic build system more complex because we would need rust compilers installed as well as go on all platforms.

I think it would be complicated to integrate both for the build system and to actually call into it. It might be worth it but it is a big task.

[giladIfrach]

With yara-x set to be the next evolution of yara (and I can already see significant performance improvements) I strongly agree there should be some way to enable it through velociraptor.

Velociraptor is cutting edge, and there's almost nothing our team can't do with it, yet we keep running external tools for both yara-x (and even regular yara for some modules) .

There are already yara artifacts in velociraptor, and I would definitely prefer to rely on velociraptor alone (utilising its comfort, logic and resource control) than switch to shelling. The demand is definitely there, it's quiet for now because yara-x is relatively new

[scudette]

I actually did look into it - there is no way to compile yara-x statically into another binary since it is written in rust it must be built as a dll/so and linked into a C program.

This means that we may be able to support it through a special plugin which is optionally available at runtime. The fact we need a dll built for the target platform makes it much more complicated to deploy (for example think of the offline collector). It also makes it more fragile (due to linking failures at runtime).

So it may be possible to support in future as an experiment.

[scudette]

It will also add about 25mb to the binary for a single plugin which is partially already available. Currently we weigh in about 73mb so an additional 25mb represents about a 30% increase in size for just one plugin.

[scudette]

I played with Yara X and submitted #4488 now. The new yarax() plugin uses it - please test.

There are some limitations I found when using it that I wrote down here

velociraptor/docs/references/vql.yaml

Line 12336 in f3b4fbc

## Some limitations with Yara X

I am not convinced it is better than the old C Yara yet - I think there are some improvements needed but it is encouraging to see it being more actively maintained.

I added a single artifact for now to use the YaraX plugin:
https://github.com/Velocidex/velociraptor/blob/master/artifacts/definitions/Windows/Detection/YaraX/Glob.yaml

Please add feedback to this thread.

[scudette]

Should be fixed in 0.75.3