forked from VirusTotal/yara
-
Notifications
You must be signed in to change notification settings - Fork 0
/
yara.man
145 lines (144 loc) · 3.11 KB
/
yara.man
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
.TH yara 1 "September 22, 2008" "Victor M. Alvarez"
.SH NAME
yara \- find files matching patterns and rules written in a special-purpose
language.
.SH SYNOPSIS
.B yara
[OPTION]... RULES_FILE FILE | DIR | PID
.SH DESCRIPTION
yara scans the given FILE, all files contained in directory DIR, or the process
identified by PID looking for matches of patterns and rules provided in a
special purpose-language. The rules are read from RULES_FILE.
.PP
The options to
.IR yara (1)
are:
.TP
.BI \-t " tag" " --tag=" tag
Print rules tagged as
.I tag
and ignore the rest. This option can be used multiple times.
.TP
.BI \-i " identifier" " --identifier=" identifier
Print rules named
.I identifier
and ignore the rest. This option can be used multiple times.
.TP
.B \-c " --count"
Print number of matches only.
.TP
.B \-n " --negate"
Print rules that doesn't apply (negate).
.TP
.B \-D " --print-module-data"
Print module data.
.TP
.B \-g " --print-tags"
Print the tags associated to the rule.
.TP
.B \-m " --print-meta"
Print metadata associated to the rule.
.TP
.B \-s " --print-strings"
Print strings found in the file.
.TP
.B \-L " --print-string-length"
Print length of strings found in the file.
.TP
.BI \-p " number" " --threads=" number
Use the specified
.I number
of threads to scan a directory.
.TP
.BI \-l " number" " --max-rules=" number
Abort scanning after a
.I number
of rules matched.
.TP
.BI \-a " seconds" " --timeout=" seconds
Abort scanning after a number of
.I seconds
has elapsed.
.TP
.BI \-k " slots" " --stack-size=" slots
Set maximum stack size to the specified number of
.I slots.
.TP
.BI \-d " identifier"=value
Define an external variable. This option can be used multiple times.
.TP
.BI \-x " module"=file
Pass file's content as extra data to module. This option can be used multiple
times.
.TP
.B \-r " --recursive"
Scan files in directories recursively.
.TP
.B \-f " --fast-scan"
Speeds up scanning by searching only for the first occurrence of each pattern.
.TP
.B \-w " --no-warnings"
Disable warnings.
.TP
.B " --fail-on-warnings"
Treat warnings as errors. Has no effect if used with
.B --no-warnings.
.TP
.BI " --max-strings-per-rule=" number
Set maximum number of strings per rule (default=10000)
.TP
.B \-v " --version"
Show version information.
.SH EXAMPLES
$ yara /foo/bar/rules .
.RS
.PP
Apply rules on
.I /foo/bar/rules
to all files on current directory. Subdirectories are not scanned.
.RE
.PP
$ yara -t Packer -t Compiler /foo/bar/rules bazfile
.RS
.PP
Apply rules on
.I /foo/bar/rules
to
.I bazfile.
Only reports rules tagged as
.I Packer
or
.I Compiler.
.RE
.PP
$ cat /foo/bar/rules | yara -r /foo
.RS
.PP
Scan all files in the
.I /foo
directory and its subdirectories. Rules are read from standard input.
.RE
.PP
$ yara -d mybool=true -d myint=5 -d mystring="my string" /foo/bar/rules bazfile
.RS
.PP
Defines three external variables
.I mybool
.I myint
and
.I mystring.
.RE
.PP
$ yara -x cuckoo=cuckoo_json_report /foo/bar/rules bazfile
.RS
.PP
Apply rules on
.I /foo/bar/rules
to
.I bazfile
while passing the content of
.I cuckoo_json_report
to the cuckoo module.
.RE
.SH AUTHOR
Victor M. Alvarez <plusvic@gmail.com>;<vmalvarez@virustotal.com>