https://github.com/marirs/dedupe_yara_rule-rs
Dedupe yara rules - Rust version
https://github.com/marirs/dedupe_yara_rule-rs
dedupe deduper rust rust-lang yara yara-rules yara-x
Last synced: 6 months ago
JSON representation
Dedupe yara rules - Rust version
- Host: GitHub
- URL: https://github.com/marirs/dedupe_yara_rule-rs
- Owner: marirs
- License: mit
- Created: 2021-08-29T12:57:20.000Z (about 4 years ago)
- Default Branch: master
- Last Pushed: 2024-10-24T06:02:50.000Z (12 months ago)
- Last Synced: 2025-04-18T08:39:35.490Z (6 months ago)
- Topics: dedupe, deduper, rust, rust-lang, yara, yara-rules, yara-x
- Language: Rust
- Homepage:
- Size: 40.5 MB
- Stars: 0
- Watchers: 1
- Forks: 2
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Deduplication of yara rules
This script takes a path of yara rules, and goes over them to identify duplicate rules if any. It then organises the output at a different output file.
It also organises & creates:
- one single file with all the rules squeezed in
- compiles and saves the compiled yara file
### Requirements
- Rust 1.70+
- Yara-X
- Jansson
- macOS: `brew install jansson`
- Linux: `apt -y install libjansson-dev libjansson4`
- Libmagic
- macOS: `brew install libmagic`
- Linux: `apt -y install libmagic1 libmagic-dev`
### Running the program
- Help
```bash
./target/release/yara_dedupe -h
Dedup yara rules and compile
Usage: yara_dedupe
Commands:
dedupe Remove duplicates from a vector of YARA rules
compile Compile a YARA rule into a binary format
help Print this message or the help of the given subcommand(s)
Options:
-h, --help Print help
-V, --version Print version
```
- Deduplicating
```bash
./target/release/yara_dedupe dedupe -i data -o all.yara
[* examining: data/email/general_phish.yar ]
* Total files processed: 51
* Total yara rules: 5546
* Total yara rules after dedupe: 5535
* Output yara file stored in: all.yara
```
- Compiling the rules
```bash
./target/release/yara_dedupe compile all.yara
* Compiled yara ruleset is stored in: compiled_all.yara
```
---
License: MIT