topic Re: Yara Rules error in Cortex XSOAR Discussions

Yara Rules error

FabioFerreira — Tue, 21 Mar 2023 15:17:11 GMT

Hi,

Trying to use yarascan automation from yara pack on marketplace, always receiving "HasMatch: false"

Here it goes the printscreen with the command and the contextdata showing the entryid

The content has that rule

Could you help?

Regards,

Fábio

Re: Yara Rules error

vidurasupun — Wed, 22 Mar 2023 07:13:34 GMT

In the context I see the yara file, What you are trying to accomplish is scan a file with a YARA rule to figure out if it matches right?

Try with the below YARA rule. This will come true for any file.

rule match_any_file { condition: true }

Let me know if it works, we'll try to troubleshoot further

Re: Yara Rules error

FabioFerreira — Wed, 22 Mar 2023 11:02:58 GMT

Hi,

I changed the yara file and added the following

And tried again with the same issue

Regards,

Fábio Ferreira

Re: Yara Rules error

chrking — Thu, 23 Mar 2023 00:20:07 GMT

I think the issue here is the arguments.

The yaraRule parameter is supposed to be a raw YARA rule, and the entryIDs parameter is a list of files to evaluate with the yara rule. (ie, the files which may or may not match a rule) In normal usage I wouldn't expect any of the entryIDs to be a .yar file, and the rule name on it's own will not compile as a valid yara rule.

If you need to use arbitrary rules inside yar files you'll need to read the data from the yar file first, then pass it to YaraScan eg with a wrapper script.

Re: Yara Rules error

FabioFerreira — Sun, 26 Mar 2023 20:39:06 GMT

Hi @chrking ,

Got it.

Thank you for your help.

Regards,

Fábio Ferreira