table of contents
other versions
- jessie 3.1.0-2+deb8u1
- jessie-backports 3.5.0+dfsg-9~bpo8+1
- stretch 3.5.0+dfsg-9
- testing 3.8.1-2
- stretch-backports 3.8.1-2~bpo9+1
- unstable 3.9.0-1
yara(1) | General Commands Manual | yara(1) |
NAME¶
yara - find files matching patterns and rules written in a special-purpose language.SYNOPSIS¶
yara [OPTION]... [RULEFILE]... FILE | PIDDESCRIPTION¶
Yara scans the given FILE or the process indentified by PID looking if it matches the patterns and rules provided in a special purpose-language. The rules are read from RULEFILEs or standard input. The options to yara(1) are:- -t tag
- Print rules tagged as tag and ignore the rest. This option can be used multiple times.
- -i identifier
- Print rules named identifier and ignore the rest. This option can be used multiple times.
- -n
- Print rules that doesn't apply (negate)
- -g
- Print the tags associated to the rule.
- -m
- Print metadata associated to the rule.
- -s
- Print strings found in the file.
- -p number
- Use the specified number of threads to scan a directory.
- -l number
- Abort scanning after a number of rules matched.
- -a seconds
- Abort scanning after a number of seconds has elapsed.
- -d identifier=value
- Define an external variable. This option can be used multiple times.
- -x module=file
- Pass file's content as extra data to module. This option can be used multiple times.
- -r
- Scan files in directories recursively.
- -f
- Speeds up scanning by searching only for the first occurrence of each pattern.
- -w
- Disable warnings.
- -v
- Show version information.
EXAMPLES¶
$ yara /foo/bar/rules1 /foo/bar/rules2 .
Apply rules on /foo/bar/rules1 and /foo/bar/rules2 to all files on
current directory. Subdirectories are not scanned.
$ yara -t Packer -t Compiler /foo/bar/rules bazfile
Apply rules on /foo/bar/rules to bazfile. Only reports rules
tagged as Packer or Compiler.
$ cat /foo/bar/rules1 | yara -r /foo
Scan all files in the /foo directory and its subdirectories. Rules are
read from standard input.
$ yara -d mybool=true -d myint=5 -d mystring="my string"
/foo/bar/rules bazfile
Defines three external variables mybool myint and
mystring.
$ yara -x cuckoo=cuckoo_json_report /foo/bar/rules bazfile
Apply rules on /foo/bar/rules to bazfile while passing the content
of cuckoo_json_report to the cuckoo module.
AUTHOR¶
Victor M. Alvarez <plusvic@gmail.com>;<vmalvarez@virustotal.com>September 22, 2008 | Victor M. Alvarez |