-
Notifications
You must be signed in to change notification settings - Fork 0
/
yara.man
176 lines (175 loc) · 3.88 KB
/
yara.man
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
.TH yara 1 "September 22, 2008" "Victor M. Alvarez"
.SH NAME
yara \- find files matching patterns and rules written in a special-purpose
language.
.SH SYNOPSIS
.B yara
[OPTION]... [NAMESPACE:]RULES_FILE... FILE | DIR | PID
.SH DESCRIPTION
yara scans the given FILE, all files contained in directory DIR, or the process
identified by PID looking for matches of patterns and rules provided in a
special purpose-language. The rules are read from one or more RULES_FILE.
.PP
The options to
.IR yara (1)
are:
.TP
.B " --atom-quality-table"
Path to a file with the atom quality table.
.TP
.B \-C " --compiled-rules"
RULES_FILE contains rules already compiled with yarac.
.TP
.B \-c " --count"
Print number of matches only.
.TP
.BI "\-d --define"=identifier=value
Define an external variable. This option can be used multiple times.
.TP
.B " --fail-on-warnings"
Treat warnings as errors. Has no effect if used with
.B --no-warnings.
.TP
.B \-f " --fast-scan"
Speeds up scanning by searching only for the first occurrence of each pattern.
.TP
.BI \-i " identifier" " --identifier=" identifier
Print rules named
.I identifier
and ignore the rest. This option can be used multiple times.
.TP
.BI " --max-process-memory-chunk=" size
While scanning process memory read data in chunks of the given
.I size
in bytes.
.TP
.BI \-l " number" " --max-rules=" number
Abort scanning after a
.I number
of rules matched.
.TP
.BI " --max-strings-per-rule=" number
Set maximum number of strings per rule (default=10000)
.TP
.BI "\-x --module-data"=module=file
Pass file's content as extra data to module. This option can be used multiple
times.
.TP
.B \-n " --negate"
Print rules that doesn't apply (negate).
.TP
.B \-w " --no-warnings"
Disable warnings.
.TP
.B \-m " --print-meta"
Print metadata associated to the rule.
.TP
.B \-D " --print-module-data"
Print module data.
.TP
.B \-M " --module-names"
show module names
.TP
.B \-e " --print-namespace"
Print namespace associated to the rule.
.TP
.B \-S " --print-stats"
Print rules' statistics.
.TP
.B \-s " --print-strings"
Print strings found in the file.
.TP
.B \-L " --print-string-length"
Print length of strings found in the file.
.TP
.B \-X " --print-xor-key"
Print xor key of matched strings.
.TP
.B \-g " --print-tags"
Print the tags associated to the rule.
.TP
.B \-r " --recursive"
Scan files in directories recursively. It follows symlinks.
.TP
.BI " --scan-list"
Scan files listed in FILE, one per line.
.TP
.BI \-z " size" " --skip-larger=" size
Skip files larger than the given
.I size
in bytes when scanning a directory.
.TP
.BI \-k " slots" " --stack-size=" slots
Set maximum stack size to the specified number of
.I slots.
.TP
.BI \-t " tag" " --tag=" tag
Print rules tagged as
.I tag
and ignore the rest. This option can be used multiple times.
.TP
.BI \-p " number" " --threads=" number
Use the specified
.I number
of threads to scan a directory.
.TP
.BI \-a " seconds" " --timeout=" seconds
Abort scanning after a number of
.I seconds
has elapsed.
.TP
.B \-v " --version"
Show version information.
.SH EXAMPLES
$ yara /foo/bar/rules .
.RS
.PP
Apply rules on
.I /foo/bar/rules
to all files on current directory. Subdirectories are not scanned.
.RE
.PP
$ yara -t Packer -t Compiler /foo/bar/rules bazfile
.RS
.PP
Apply rules on
.I /foo/bar/rules
to
.I bazfile.
Only reports rules tagged as
.I Packer
or
.I Compiler.
.RE
.PP
$ cat /foo/bar/rules | yara -r /foo
.RS
.PP
Scan all files in the
.I /foo
directory and its subdirectories. Rules are read from standard input.
.RE
.PP
$ yara -d mybool=true -d myint=5 -d mystring="my string" /foo/bar/rules bazfile
.RS
.PP
Defines three external variables
.I mybool
.I myint
and
.I mystring.
.RE
.PP
$ yara -x cuckoo=cuckoo_json_report /foo/bar/rules bazfile
.RS
.PP
Apply rules on
.I /foo/bar/rules
to
.I bazfile
while passing the content of
.I cuckoo_json_report
to the cuckoo module.
.RE
.SH AUTHOR
Victor M. Alvarez <[email protected]>;<[email protected]>