Yara Rules error

[FabioFerreira]

Hi,

Trying to use yarascan automation from yara pack on marketplace, always receiving "HasMatch: false"

Here it goes the printscreen with the command and the contextdata showing the entryid

The content has that rule

Could you help?

Regards,

Fábio

[vidurasupun]

In the context I see the yara file, What you are trying to accomplish is scan a file with a YARA rule to figure out if it matches right?

Try with the below YARA rule. This will come true for any file. 

rule match_any_file { condition: true }

Let me know if it works, we'll try to troubleshoot further

[FabioFerreira]

Hi,

I changed the yara file and added the following

And tried again with the same issue

Regards,

Fábio Ferreira

[chrking · Accepted solution]

I think the issue here is the arguments. 

The yaraRule parameter is supposed to be a raw YARA rule, and the entryIDs parameter is a list of files to evaluate with the yara rule. (ie, the files which may or may not match a rule) In normal usage I wouldn't expect any of the entryIDs to be a .yar file, and the rule name on it's own will not compile as a valid yara rule.

If you need to use arbitrary rules inside yar files you'll need to read the data from the yar file first, then pass it to YaraScan eg with a wrapper script.

[FabioFerreira]

Hi @chrking ,

Got it.

Thank you for your help.

Regards,

Fábio Ferreira