https://github.com/mitre/yararules-python

Easily scan with multiple yara rules from different sources.
https://github.com/mitre/yararules-python

Last synced: about 1 year ago
JSON representation

Easily scan with multiple yara rules from different sources.

• Host: GitHub
• URL: https://github.com/mitre/yararules-python
• Owner: mitre
• License: other
• Created: 2018-05-14T20:03:17.000Z (about 8 years ago)
• Default Branch: master
• Last Pushed: 2024-03-09T02:53:25.000Z (over 2 years ago)
• Last Synced: 2025-04-21T16:41:16.158Z (over 1 year ago)
• Language: Python
• Size: 8.79 KB
• Stars: 13
• Watchers: 4
• Forks: 9
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

          
Scan files and directories with multiple rules files, without cross-file rule name collision!

Files containing rules can be provided on the command-line, as a list in one or more text

files, as a directory containing (just) rules files, or in a config dir.  Each option

(-d -f -l) can be provided multiple times.

Default output is space-separated RULE NAME, RULE FILE, and MATCH FILE.  Use CSV option

for comma-separated values.

## Installation

```bash

pip install .

```

## Usage

~~~~

usage: yara-multi-rules.py [-h] [-d SIGDIRS] [-f SIGFILES] [-l LISTFILES] [-v]

                           [--csv] [-m] [--quiet] [--init]

                           [--config-dir CONFIGDIR] [--fail-on-warnings]

                           FILE [FILE ...]

positional arguments:

  FILE                  file(s) to scan

optional arguments:

  -h, --help            show this help message and exit

  -d SIGDIRS            Directory containing rules

  -f SIGFILES           rule file (allowed multiple times for list)

  -l LISTFILES          file containing path to rule files, one per line

  -v                    verbose output

  --csv                 output in CSV format

  -m                    only show matches

  --quiet, -q           only display match/none, no informational messages

  --init                Create a blank config (default: ~/.yara/)

  --config-dir CONFIGDIR

                        Use/create configuration in given directory.

  --fail-on-warnings    Error on warnings during rule compilation

~~~~

## Copyright

Copyright (c) 2018-2020, The MITRE Corporation. All rights reserved.

Approved for Public Release; Distribution Unlimited. Case Number 18-0989