Yara python module – part 001 .

YARA is a multi-platform program running on Windows, Linux and Mac OS X.
More about Yara python module can see it here.
YARA used this keyword with rules under files.

The Yara documentation can be found in this link.
The Yara python module uses version 1.7.7 and this will need to use when making rules.
Installation with pip :

Let’s see this in action.
First, you need to make your user under the your_user account.
I make one folder named Yara to keep my rules see:

and I test this file named doc_data.txt, from here:

The file has this text :

and the rule file detects string has this rule:

You can use the python shell with this source code:

The above rule is telling YARA that the file containing the string must be reported.
The print will show the rule compiled and the result.
yara python

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.