allow to specify the file location as a rule condition

[plusvic]

From asafd...@gmail.com on May 28, 2011 17:42:03

I'd like to be able to specify the file location (either an absolute folder such as C:\Windows\System32 or folders subtree such as C:\Windows\System32**) as a condition to a rule.
rule will match only if the the condition satisfies and the file is in the specified location

thanks

Original issue: http://code.google.com/p/yara-project/issues/detail?id=19

[plusvic]

From plus...@gmail.com on May 28, 2011 14:52:07

YARA rules are agnostic about the file path they are analyzing, and should be kept that way because rules can be applied not only to files, but to data buffers and proceses as well. However you can do what you want by writing your own Python script usingthe yara-python extension.

Status: WontFix
Labels: -Type-Defect Type-Enhancement