<!--
 - YARA rules
 - Created by SOCFortress.
 - https://www.socfortress.co
 - info@socfortress.co.
-->

<group name="yara,">
    <rule id="200100" level="1">
        <decoded_as>yara</decoded_as>
        <description>YARA rules grouped.</description>
    </rule>

    <rule id="200101" level="5">
        <if_sid>200100</if_sid>
        <field name="error_message">\.+</field>
        <description>YARA error detected.</description>
    </rule>

    <rule id="200102" level="7">
        <if_sid>200100</if_sid>
        <field name="warning_message">\.+</field>
        <description>YARA limit reached.</description>
    </rule>

    <rule id="200103" level="12">
        <if_sid>200100</if_sid>
        <field name="yara_info">\.+</field>
        <mitre>
           <id>T1204</id>
        </mitre>
        <description>YARA $(yara_rule) detected.</description>
    </rule>
</group>
