yara rules

launching yara rule:

yara rule.yar sample.file

here rule.yar is a yara rule made by someone.

sample.file is the malicious file which against you want to run the rule.

Now lets say you have so many yara rules saved in a directory. now if you run this one by one then it would take so many times. so lets see how we can run those rules using for loop.

/home/student/Downloads/yara-forensics/file or raw say in these both directories we have some .yar rules files. we want to run those against some malicious files. here malicious file name is sample.file

-c for count 

 

for file in $(find /home/student/Downloads/yara-forensics/file -name '*.yar'); do test $(yara -c ${file} /home/student/Downloads/sample.file) -gt 0 && echo $file; done 2>/dev/null

for file in $(find /home/student/Downloads/yara-forensics/raw -name '*.yar'); do test $(yara -c ${file} /home/student/Downloads/sample.file) -gt 0 && echo $file; done 2>/dev/null

Avi