Skip to content

k-sec-tools/YaraFileCheckerLib

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

7 Commits
 
 
 
 
 
 
 
 
 
 

Repository files navigation

yara_file_cheсker

the library is designed to make it easier to check potentially malicious files and archives using YARA and make a decision about their harmfulness based on the weights of the detected rules

Config:

  • FileSizeLimitKb: !!int // limit: limit of summary checked files size (archived files included)
  • ArchiveDepthLimit: !!int // limit: how many nested archives we can check
  • ProcessingTimeLimitMs: !!int // limit: how much time to wait until stoping check
  • FilesCountLimit: !!int // limit: how many files in archive we can check
  • DangerousThreshold: !!int // setting: threshold, after reaching which (based on the sum of the weights of the yara rules that matched during file processing) a decision is made that the file is malicious and processing stops
  • YaraRuleScoreDefault: !!int // setting: the weight of the yara rule, unless otherwise specified in the score_ tag
  • ScanArchives: !!bool // setting: whether to scan archives. the 7z.dll library is required in the Resources folder
  • FastScan: !!bool // setting: yara fast scan
  • ArchiveFileTypes: array // setting - list of archive file extensions
  • ExecutableExtensions: array// setting - list of executable file extensions

Using:

var log = new SynchronousConsoleLog(); 
var fileChecker = new FileChecker();
var fileBytes = ReadFileBytes(sampleFilePath);
var fileObject = new FileObject(fileBytes, sampleFilePath); 
var scanMode = FileChecker.ScanMode.Mid; 
/*
rules from:
- Lite -  Resources/YaraRules/Lite
- Mid - Lite + Resources/YaraRules/Mid
- Hard - Mid + Resources/YaraRules/Hard
- Custom - Resources/YaraRules/custom. 
*/

var result = fileChecker.CheckFile(fileObject, scanMode, log); // FileScanResult со следующими свойствами%
/*
    ScanSuccessful - is scan successful (if not - check AdditionalInfo)
    YaraResults - list of ScanResult https://github.com/microsoft/libyara.NET/blob/master/libyara.NET/ScanResult.h
    AdditionalInfo
    FileName - file name/ filenames delimited with | in case of checking archives
    MatchedRules - list of matched rules names
    Executable - is executable/ archive contains one or more executables
    TotalScore - summ of yara rule scores (from tag score_XXX or from YaraRuleScoreDefault in config)
    Dangerous - is DangerousThreshold reached
*/

About

No description, website, or topics provided.

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published