main/Yara

YARA Integration

YARA is a tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families (or whatever you want to describe) based on textual or binary patterns. Each description, a.k.a. rule, consists of a set of strings and a boolean expression which determine its logic.

Must have YARA installed on your endpoints

YARA Github

Set your YARA scan to run at set intervals by incorporating a Cronjob to run the yara_full_scan.sh script.

Need Help?

SOCFortress - - info@socfortress.co

Let SOCFortress Professional Services Take Your Open Source SIEM to the Next Level