yara(1) General Commands Manual yara(1) NAME yara - find files matching patterns and rules written in a special-purpose language. SYNOPSIS yara [OPTION]... [NAMESPACE:]RULES_FILE... FILE | DIR | PID DESCRIPTION yara scans the given FILE, all files contained in directory DIR, or the process identified by PID looking for matches of patterns and rules pro- vided in a special purpose-language. The rules are read from one or more RULES_FILE. The options to yara(1) are: --atom-quality-table Path to a file with the atom quality table. -C --compiled-rules RULES_FILE contains rules already compiled with yarac. -c --count Print number of matches only. -d --define=identifier=value Define an external variable. This option can be used multiple times. --fail-on-warnings Treat warnings as errors. Has no effect if used with --no-warnings. -f --fast-scan Speeds up scanning by searching only for the first occurrence of each pattern. -i identifier --identifier=identifier Print rules named identifier and ignore the rest. This option can be used multiple times. --max-process-memory-chunk=size While scanning process memory read data in chunks of the given size in bytes. -l number --max-rules=number Abort scanning after a number of rules matched. --max-strings-per-rule=number Set maximum number of strings per rule (default=10000) -x --module-data=module=file Pass file's content as extra data to module. This option can be used multiple times. -n --negate Print rules that doesn't apply (negate). -w --no-warnings Disable warnings. -m --print-meta Print metadata associated to the rule. -D --print-module-data Print module data. -M --module-names show module names -e --print-namespace Print namespace associated to the rule. -S --print-stats Print rules' statistics. -s --print-strings Print strings found in the file. -L --print-string-length Print length of strings found in the file. -X --print-xor-key Print xor key of matched strings. -g --print-tags Print the tags associated to the rule. -r --recursive Scan files in directories recursively. It follows symlinks. --scan-list Scan files listed in FILE, one per line. -z size --skip-larger=size Skip files larger than the given size in bytes when scanning a di- rectory. -k slots --stack-size=slots Set maximum stack size to the specified number of slots. --strict-escape Print warnings if rules contain ambiguous escape statements. -t tag --tag=tag Print rules tagged as tag and ignore the rest. This option can be used multiple times. -p number --threads=number Use the specified number of threads to scan a directory. -a seconds --timeout=seconds Abort scanning after a number of seconds has elapsed. -v --version Show version information. EXAMPLES $ yara /foo/bar/rules . Apply rules on /foo/bar/rules to all files on current directory. Subdirectories are not scanned. $ yara -t Packer -t Compiler /foo/bar/rules bazfile Apply rules on /foo/bar/rules to bazfile. Only reports rules tagged as Packer or Compiler. $ cat /foo/bar/rules | yara -r /foo Scan all files in the /foo directory and its subdirectories. Rules are read from standard input. $ yara -d mybool=true -d myint=5 -d mystring="my string" /foo/bar/rules bazfile Defines three external variables mybool myint and mystring. $ yara -x cuckoo=cuckoo_json_report /foo/bar/rules bazfile Apply rules on /foo/bar/rules to bazfile while passing the content of cuckoo_json_report to the cuckoo module. AUTHOR Victor M. Alvarez <plusvic@gmail.com>;<vmalvarez@virustotal.com> Victor M. Alvarez September 22, 2008 yara(1)
NAME | SYNOPSIS | DESCRIPTION | EXAMPLES | AUTHOR
Want to link to this manual page? Use this URL:
<https://man.FreeBSD.org/cgi/man.cgi?query=yara&sektion=1&manpath=FreeBSD+Ports+15.1.quarterly>