Yara

Yara
Repos
​https://github.com/virustotal/yara​
​Awesome Yara​
Documentación
​https://yara.readthedocs.io/​
Sintaxis
By "fr0gger_"
Comandos
yara $YARA_RULE_FILE $FILE_TO_ANALYZE
​
# Analizar recursivamente
yara -m -s -r yara_rule.yara /root/malware
Crear Yara Rules
​https://www.nextron-systems.com/2015/02/16/write-simple-sound-yara-rules/​
​https://www.bsk-consulting.de/2015/10/17/how-to-write-simple-but-sound-yara-rules-part-2/​
​https://www.bsk-consulting.de/2016/04/15/how-to-write-simple-but-sound-yara-rules-part-3/​
YarGen
​https://github.com/Neo23x0/yarGen​
Crear y updatear la base de datos
python3 yarGen.py --update
Crear una regla básica escanando recursivamente todos los archivos de un directorio
python3 yarGen.py -m /root/Desktop/Malware -o $OUTPUT
Crear Yara Rule basado en un archivo malicioso
python3 yarGen.py -m $MALICIOUS_FILE --excludegood -o $OUTPUT
Loki
Repo
​https://github.com/Neo23x0/Loki​
Comandos
# Escanear todos los archivos en un directorio.
python loky.py -p $DIRECTORY_TO_ANALYZEPYT
THOR
Web
​Thor Lite​
Fenrir
​https://github.com/Neo23x0/Fenrir​
ClamAV
​http://www.clamav.net/​
Comandos
clamscan $FILE_TO_SCAN
clamscan $FOLDER_TO_SCAN
VScan
​https://github.com/mstone/vscan​
Yaya
​https://github.com/EFForg/yaya​
Valhalla
​https://valhalla.nextron-systems.com/​
​

Última actualización 11mo ago