mirror of
https://github.com/VirusTotal/yara.git
synced 2026-10-12 02:10:00 +00:00
182 lines
4.8 KiB
ReStructuredText
182 lines
4.8 KiB
ReStructuredText
.. _command-line:
|
||
|
||
**********************************
|
||
Running YARA from the command-line
|
||
**********************************
|
||
|
||
In order to invoke YARA you’ll need two things: a file with the rules you want
|
||
to use and the target to be scanned. The target can be a file, a folder, or a
|
||
process. ::
|
||
|
||
yara [OPTIONS] RULES_FILE TARGET
|
||
|
||
In YARA 3.8 and below ``RULES_FILE`` was allowed to be a file with rules in source
|
||
form or in compiled form indistinctly. In YARA 3.9 you need to explictly specify
|
||
that ``RULES_FILE`` contains compiled rules by using the -C flag. ::
|
||
|
||
yara [OPTIONS] -C RULES_FILE TARGET
|
||
|
||
This is a security measure to prevent users from inadvertenly using compiled
|
||
rules coming from a third-party. Using compiled rules from untrusted sources can
|
||
lead to the execution of malicious code in your computer.
|
||
|
||
For compiling rules beforhand you can use the ``yarac`` tool. This way can save
|
||
time, because for YARA it is faster to load compiled rules than compiling the
|
||
same rules over and over again.
|
||
|
||
You can also pass multiple source files to `yara` like in the following example::
|
||
|
||
yara [OPTIONS] RULES_FILE_1 RULES_FILE_2 RULES_FILE_3 TARGET
|
||
|
||
Notice however that this only works for rules in source form. When invoking YARA
|
||
with compiled rules a single file is accepted.
|
||
|
||
In the example above all rules share the same "default" namespace, which means
|
||
that rule identifiers must be unique among all files. However you can specify a
|
||
namespace for individual files. For example ::
|
||
|
||
yara [OPTIONS] namespace1:RULES_FILE_1 RULES_FILE_2 RULES_FILE_3 TARGET
|
||
|
||
In this case ``RULE_FILE_1`` uses ``namespace1`` while ``RULES_FILE_2`` and
|
||
``RULES_FILE_3`` share the default namespace.
|
||
|
||
In all cases rules will be applied to the target specified as the last argument
|
||
to YARA, if it’s a path to a directory all the files contained in it will be
|
||
scanned. By default YARA does not attempt to scan directories recursively, but
|
||
you can use the ``-r`` option for that.
|
||
|
||
Available options are:
|
||
|
||
.. program:: yara
|
||
|
||
.. option:: -t <tag> --tag=<tag>
|
||
|
||
Print rules tagged as <tag> and ignore the rest.
|
||
|
||
.. option:: -i <identifier> --identifier=<identifier>
|
||
|
||
Print rules named <identifier> and ignore the rest.
|
||
|
||
.. option:: -C --compiled-rules
|
||
|
||
RULES_FILE contains rules already compiled with yarac.
|
||
|
||
.. option:: -c --count
|
||
|
||
Print only number of matches.
|
||
|
||
.. option:: -n
|
||
|
||
Print not satisfied rules only (negate).
|
||
|
||
.. option:: -D --print-module-data
|
||
|
||
Print module data.
|
||
|
||
.. option:: -g --print-tags
|
||
|
||
Print tags.
|
||
|
||
.. option:: -m --print-meta
|
||
|
||
Print metadata.
|
||
|
||
.. option:: -s --print-strings
|
||
|
||
Print matching strings.
|
||
|
||
.. option:: -L --print-string-length
|
||
|
||
Print length of matching strings.
|
||
|
||
.. option:: -e --print-namespace
|
||
|
||
Print rules' namespace.
|
||
|
||
.. option:: -p <number> --threads=<number>
|
||
|
||
Use the specified <number> of threads to scan a directory.
|
||
|
||
.. option:: -l <number> --max-rules=<number>
|
||
|
||
Abort scanning after matching a number of rules.
|
||
|
||
.. option:: -a <seconds> --timeout=<seconds>
|
||
|
||
Abort scanning after a number of seconds has elapsed.
|
||
|
||
.. option:: -k <slots> --stack-size=<slots>
|
||
|
||
Allocate a stack size of "slots" number of slots. Default: 16384. This
|
||
will allow you to use larger rules, albeit with more memory overhead.
|
||
|
||
.. versionadded:: 3.5.0
|
||
|
||
.. option:: --max-strings-per-rule=<number>
|
||
|
||
Set maximum number of strings per rule (default=10000). If a rule has more
|
||
then the specified number of strings an error will occur.
|
||
|
||
.. versionadded:: 3.7.0
|
||
|
||
.. option:: -d <identifier>=<value>
|
||
|
||
Define external variable.
|
||
|
||
.. option:: -x <module>=<file>
|
||
|
||
Pass file's content as extra data to module.
|
||
|
||
.. option:: --scan-list
|
||
|
||
Scan files listed in FILE, one per line.
|
||
|
||
.. option:: -r --recursive
|
||
|
||
Recursively search for directories. It follows symlinks.
|
||
|
||
.. option:: -f --fast-scan
|
||
|
||
Fast matching mode.
|
||
|
||
.. option:: -w --no-warnings
|
||
|
||
Disable warnings.
|
||
|
||
.. option:: --fail-on-warnings
|
||
|
||
Treat warnings as errors. Has no effect if used with --no-warnings.
|
||
|
||
.. option:: -v --version
|
||
|
||
Show version information.
|
||
|
||
.. option:: -h --help
|
||
|
||
Show help.
|
||
|
||
Here you have some examples:
|
||
|
||
* Apply rule in */foo/bar/rules* to all files in the current directory.
|
||
Subdirectories are not scanned::
|
||
|
||
yara /foo/bar/rules .
|
||
|
||
* Apply rules in */foo/bar/rules* to *bazfile*. Only reports rules tagged as
|
||
*Packer* or *Compiler*::
|
||
|
||
yara -t Packer -t Compiler /foo/bar/rules bazfile
|
||
|
||
* Scan all files in the */foo* directory and its subdirectories::
|
||
|
||
yara /foo/bar/rules -r /foo
|
||
|
||
* Defines three external variables *mybool*, *myint* and *mystring*::
|
||
|
||
yara -d mybool=true -d myint=5 -d mystring="my string" /foo/bar/rules bazfile
|
||
|
||
* Apply rules in */foo/bar/rules* to *bazfile* while passing the content of
|
||
*cuckoo_json_report* to the cuckoo module::
|
||
|
||
yara -x cuckoo=cuckoo_json_report /foo/bar/rules bazfile
|