YARA - File Scan

A playbook to run YARA scan against uploaded file. To run the playbook, provide the YARA rule content and the entry ID of the file you intend to scan.

Yara · 10 tasks · 3 inputs · 14 outputs

Details

ID	`YARA - File Scan`
From Version	6.8.0
Tasks	10

README

A playbook to run YARA scan against uploaded file.
To run the playbook, provide the YARA rule content and the entry ID of the file you intend to scan.

Scripts

YaraScan

Playbook Inputs

Name	Description	Default Value	Required
EntryID	The entry ID of a file to scan	File.EntryID	Optional
YARA	The YARA rule content		Optional

Playbook Outputs

Path	Description	Type
Yara	The Yara context path	unknown
Yara.Filename	The filename of the file that was scanned.	string
Yara.HasError	Whether there was an error when performing the scan.	boolean
Yara.HasMatch	Whether the file matched any of the rules.	boolean
Yara.entryID	The entry ID of the scanned file.	string
Yara.fileID	The file ID of the scanned file.	string
Yara.MatchCount	The number of rules that matched the file.	number
Errors	A list of errors that occurred during the scan.	unknown
Matches	The matches from the YARA scan.	unknown
Matches.Meta	Metadata about the rule (as defined in the rule itself).	unknown
Matches.Namespace	The namespace defined in the rule.	string
Matches.RuleName	The rule name that matched.	string
Matches.Strings	A list of strings that the rule matched.	string
Matches.Tags	A list of tags that are defined in the rule.	unknown

Playbook Image

YARA - File Scan

Inputs

EntryID — The entry ID of a file to scan
YARA — The YARA rule content
Query — A query to match the relevant YARA rule indicators from TIM. Example: type:"YARA Rule"

Outputs

Yara — The Yara context path.
Yara.Filename — The filename of the file that was scanned.
Yara.HasError — Whether there was an error when performing the scan.
Yara.HasMatch — Whether the file matched any of the rules.
Yara.entryID — The entry ID of the scanned file.
Yara.fileID — The file ID of the scanned file.
Yara.MatchCount — The number of rules that matched the file.
Errors — A list of errors that occurred during the scan.
Matches — The matches from the YARA scan.
Matches.Meta — Metadata about the rule (as defined in the rule itself).
Matches.Namespace — The namespace defined in the rule.
Matches.RuleName — The rule name that matched.
Matches.Strings — A list of strings that the rule matched.
Matches.Tags — A list of tags that are defined in the rule.

Flowchart

Source

playbook-YARA_-_File_Scan.yml

Download History Raw

id: YARA - File Scan
version: -1
name: YARA - File Scan
fromversion: 6.8.0
description: |-
  A playbook to run YARA scan against uploaded file.
  To run the playbook, provide the YARA rule content and the entry ID of the file you intend to scan.

starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: c4bd7186-7d67-4ee5-8e97-ab3e451af4e7
    type: start
    task:
      id: c4bd7186-7d67-4ee5-8e97-ab3e451af4e7
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 275,
          "y": 70
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: c3951e76-5254-4892-8711-3efd871b16c5
    type: condition
    task:
      id: c3951e76-5254-4892-8711-3efd871b16c5
      version: -1
      name: Check If Entry ID and YARA rule content exists
      description: Checks whether Entry ID and YARA rule content inputs provided
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.EntryID
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.YARA
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -105,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 172f2408-5edd-4d5c-8348-c3954013e5ac
    type: regular
    task:
      id: 172f2408-5edd-4d5c-8348-c3954013e5ac
      version: -1
      name: Run YARA scan
      description: Performs a YARA scan on the specified files.
      scriptName: YaraScan
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      entryIDs:
        complex:
          root: inputs.EntryID
          transformers:
          - operator: uniq
      yaraRule:
        complex:
          root: inputs.YARA
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -105,
          "y": 790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: ffe12c73-1999-44fe-8f58-a3d1108530b5
    type: title
    task:
      id: ffe12c73-1999-44fe-8f58-a3d1108530b5
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 10228755-d924-4afc-8059-1f7473f57e18
    type: condition
    task:
      id: 10228755-d924-4afc-8059-1f7473f57e18
      version: -1
      name: Was a query provided?
      description: Check if a query was provided by the user to use YARA Rule indicators instead of a manual input.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Query
                transformers:
                - operator: toLowerCase
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 275,
          "y": 205
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 85d1edac-1181-447e-84c5-6f9c3e646ca0
    type: condition
    task:
      id: 85d1edac-1181-447e-84c5-6f9c3e646ca0
      version: -1
      name: YARA indicators found
      description: Check if the query returned any indicators.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "Yes":
      - "7"
    separatecontext: false
    conditions:
    - label: "Yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: ${foundIndicators}
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 655,
          "y": 790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 1d3bd7e3-012a-441d-89eb-c81d8efe8a89
    type: regular
    task:
      id: 1d3bd7e3-012a-441d-89eb-c81d8efe8a89
      version: -1
      name: Run YARA scan
      description: Performs a YARA scan on the specified files.
      scriptName: YaraScan
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      entryIDs:
        complex:
          root: inputs.EntryID
          transformers:
          - operator: uniq
      yaraRule:
        complex:
          root: foundIndicators
          accessor: rawrule
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 655,
          "y": 1065
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 5f3b0e78-f228-4af5-849e-4a9f2da3bcc8
    type: regular
    task:
      id: 5f3b0e78-f228-4af5-849e-4a9f2da3bcc8
      version: -1
      name: Search Yara Rules Indicator
      description: |
        Searches XSOAR for the required YARA Rule Indicators to scan the files with. The search returns the "Raw Rule" field to use for the scan.
      scriptName: SearchIndicator
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      add_fields_to_context:
        simple: rawrule
      query:
        simple: ${inputs.Query}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 655,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: b8aa239a-271f-4c9f-8f29-c4b7b632f528
    type: title
    task:
      id: b8aa239a-271f-4c9f-8f29-c4b7b632f528
      version: -1
      name: Manual Rule Input
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -105,
          "y": 390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 7dae5720-6bda-48c2-810e-cbb3a52ebd6a
    type: title
    task:
      id: 7dae5720-6bda-48c2-810e-cbb3a52ebd6a
      version: -1
      name: Using YARA Rule Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 655,
          "y": 390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "1_2_yes": 0.73,
      "1_3_#default#": 0.54,
      "6_3_#default#": 0.5
    },
    "paper": {
      "dimensions": {
        "height": 1240,
        "width": 1140,
        "x": -105,
        "y": 70
      }
    }
  }
inputs:
- key: EntryID
  value:
    complex:
      root: File
      accessor: EntryID
      transformers:
      - operator: uniq
  required: false
  description: The entry ID of a file to scan
  playbookInputQuery:
- key: YARA
  value: {}
  required: false
  description: The YARA rule content
  playbookInputQuery:
- key: Query
  value:
    simple: 
  required: false
  description: |-
    A query to match the relevant YARA rule indicators from TIM.

    Example: type:"YARA Rule"
  playbookInputQuery:
outputs:
- contextPath: Yara
  type: unknown
  description: The Yara context path.
- contextPath: Yara.Filename
  description: The filename of the file that was scanned.
  type: string
- contextPath: Yara.HasError
  description: Whether there was an error when performing the scan.
  type: boolean
- contextPath: Yara.HasMatch
  description: Whether the file matched any of the rules.
  type: boolean
- contextPath: Yara.entryID
  description: The entry ID of the scanned file.
  type: string
- contextPath: Yara.fileID
  description: The file ID of the scanned file.
  type: string
- contextPath: Yara.MatchCount
  description: The number of rules that matched the file.
  type: number
- contextPath: Errors
  description: A list of errors that occurred during the scan.
- contextPath: Matches
  description: The matches from the YARA scan.
  type: unknown
- contextPath: Matches.Meta
  description: Metadata about the rule (as defined in the rule itself).
- contextPath: Matches.Namespace
  description: The namespace defined in the rule.
  type: string
- contextPath: Matches.RuleName
  description: The rule name that matched.
  type: string
- contextPath: Matches.Strings
  description: A list of strings that the rule matched.
  type: string
- contextPath: Matches.Tags
  description: A list of tags that are defined in the rule.
tests:
- No tests (auto formatted)
contentitemexportablefields:
  contentitemfields: {}