YARA - File Scan

A playbook to run YARA scan against uploaded file. To run the playbook, provide the YARA rule content and the entry ID of the file you intend to scan.

Yara · 10 tasks · 3 inputs · 14 outputs

Inputs

  • EntryID — The entry ID of a file to scan
  • YARA — The YARA rule content
  • Query — A query to match the relevant YARA rule indicators from TIM. Example: type:"YARA Rule"

Outputs

  • Yara — The Yara context path.
  • Yara.Filename — The filename of the file that was scanned.
  • Yara.HasError — Whether there was an error when performing the scan.
  • Yara.HasMatch — Whether the file matched any of the rules.
  • Yara.entryID — The entry ID of the scanned file.
  • Yara.fileID — The file ID of the scanned file.
  • Yara.MatchCount — The number of rules that matched the file.
  • Errors — A list of errors that occurred during the scan.
  • Matches — The matches from the YARA scan.
  • Matches.Meta — Metadata about the rule (as defined in the rule itself).
  • Matches.Namespace — The namespace defined in the rule.
  • Matches.RuleName — The rule name that matched.
  • Matches.Strings — A list of strings that the rule matched.
  • Matches.Tags — A list of tags that are defined in the rule.

Flowchart

yes yes Yes Start Start Check If Entry ID and YARA rule content exists Check If Entry ID and YAR... Run YARA scan - YaraScan Run YARA scan YaraScan Done Done Was a query provided? Was a query provided? YARA indicators found YARA indicators found Run YARA scan - YaraScan Run YARA scan YaraScan Search Yara Rules Indicator - SearchIndicator Search Yara Rules Indicator SearchIndicator Manual Rule Input Manual Rule Input Using YARA Rule Indicators Using YARA Rule Indicators