Skip to content

feat(filter): YARA filter function#147

Merged
rabbitstack merged 10 commits into
masterfrom
yara-filter-function
Jan 19, 2023
Merged

feat(filter): YARA filter function#147
rabbitstack merged 10 commits into
masterfrom
yara-filter-function

Conversation

@rabbitstack
Copy link
Copy Markdown
Owner

YARA function enables the consolidation of signature and behavior-based detections by providing the ability to run YARA rules in Fibratus filters and rules. The yara function exposes the following arguments:

  • pid|file|bytes, either the pid, filename or the byte chunk to be scanned by the YARA engine
  • rules YARA rules that are executed on one of the above targets
  • vars map of variable definitions to be replaced in YARA rules

@rabbitstack rabbitstack merged commit 9b34161 into master Jan 19, 2023
@rabbitstack rabbitstack deleted the yara-filter-function branch January 19, 2023 18:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant