a-ray-grass
YARA module for supporting DCSO format bloom filters with hashlookup capabilities.
a-ray-grass
YARA module for supporting DCSO format bloom filters with hashlookup capabilities.
a-ray-grass Description
a-ray-grass is a YARA module that provides support for DCSO format bloom filters in YARA. In the context of hashlookup, it allows quickly discard known files 'pour séparer le grain de l'ivraie'. Installation: - Copy the folder libyara/fleur in libyara - Copy the folder libyara/modules/araygrass in libyara/modules - Modify libyara/Makefile.am - Add modules/araygrass/araygrass.c to the MODULES variable - Add fleur/fnv.c and fleur/fleur.c to the libyara_la_SOURCES variable - Modify /libyara/modules/module_list - Append MODULE(araygrass) at the end of the file - Finally modify libyara/modules/araygrass/araygrass.c There you will find two paths defined: - BF_PATH_IN: specify here the path to your input bloom filter, the filter against which variables will be checked - BF_PATH_OUT: specify here the path where you wish to save the modified bloom filter after YARA finished its execution. It can be left empty if no modifications are made to the filter. It's totally ok to set the same path for both variables. Compilation: - Go back to YARA's root folder and make
a-ray-grass FAQ
Common questions about a-ray-grass including features, pricing, alternatives, and user reviews.
a-ray-grass is YARA module for supporting DCSO format bloom filters with hashlookup capabilities.. It is a Security Operations solution designed to help security teams with Binary Analysis, YARA.
ALTERNATIVES
A Windows context menu integration tool that scans files and folders for malware patterns, crypto signatures, and malicious documents using Yara rules and PEID signatures.
Malware analysis platform for SOC teams with binary analysis and threat detection
Fnord is a pattern extraction tool that analyzes obfuscated code using sliding window techniques to identify frequent byte sequences and generate experimental YARA rules for malware analysis.
Use FindYara, an IDA python plugin, to scan your binary with yara rules and quickly jump to matches.
POPULAR
TRENDING CATEGORIES
Stay Updated with Mandos Brief
Get strategic cybersecurity insights in your inbox