- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
03-21-2023 08:17 AM
Hi,
Trying to use yarascan automation from yara pack on marketplace, always receiving "HasMatch: false"
Here it goes the printscreen with the command and the contextdata showing the entryid
The content has that rule
Could you help?
Regards,
Fábio
03-22-2023 05:20 PM
I think the issue here is the arguments.
The yaraRule parameter is supposed to be a raw YARA rule, and the entryIDs parameter is a list of files to evaluate with the yara rule. (ie, the files which may or may not match a rule) In normal usage I wouldn't expect any of the entryIDs to be a .yar file, and the rule name on it's own will not compile as a valid yara rule.
If you need to use arbitrary rules inside yar files you'll need to read the data from the yar file first, then pass it to YaraScan eg with a wrapper script.
03-22-2023 12:13 AM
In the context I see the yara file, What you are trying to accomplish is scan a file with a YARA rule to figure out if it matches right?
Try with the below YARA rule. This will come true for any file.
rule match_any_file { condition: true }
Let me know if it works, we'll try to troubleshoot further
03-22-2023 04:02 AM
Hi,
I changed the yara file and added the following
And tried again with the same issue
Regards,
Fábio Ferreira
03-22-2023 05:20 PM
I think the issue here is the arguments.
The yaraRule parameter is supposed to be a raw YARA rule, and the entryIDs parameter is a list of files to evaluate with the yara rule. (ie, the files which may or may not match a rule) In normal usage I wouldn't expect any of the entryIDs to be a .yar file, and the rule name on it's own will not compile as a valid yara rule.
If you need to use arbitrary rules inside yar files you'll need to read the data from the yar file first, then pass it to YaraScan eg with a wrapper script.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!