EVOLUTION-MANAGER
Edit File: YaraRules.html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta http-equiv="Content-Style-Type" content="text/css" /> <meta name="generator" content="pandoc" /> <title></title> <style type="text/css">code{white-space: pre;}</style> <link rel="stylesheet" href="/en/github.css" type="text/css" /> </head> <body> <h1 id="using-yara-rules-in-clamav">Using YARA rules in ClamAV</h1> <p>ClamAV version 0.99 and above can process YARA rules. ClamAV virus database file names ending with “.yar” or “.yara” are parsed as yara rule files. The link to the YARA rule grammar documentation may be found at <a href="http://plusvic.github.io/yara/" class="uri">http://plusvic.github.io/yara/</a>. There are currently a few limitations on using YARA rules within ClamAV:</p> <ul> <li><p>YARA modules are not yet supported by ClamAV. This includes the “import” keyword and any YARA module-specific keywords.</p></li> <li><p>Global rules(“global” keyword) are not supported by ClamAV.</p></li> <li><p>External variables(“contains” and “matches” keywords) are not supported.</p></li> <li><p>YARA rules pre-compiled with the <em>yarac</em> command are not supported.</p></li> <li><p>As in the ClamAV logical and extended signature formats, YARA strings and segments of strings separated by wild cards must represent at least two octets of data.</p></li> <li><p>There is a maximum of 64 strings per YARA rule.</p></li> <li><p>YARA rules in ClamAV must contain at least one literal, hexadecimal, or regular expression string.</p></li> </ul> <p>In addition, there are a few more ClamAV processing modes that may affect the outcome of YARA rules.</p> <ul> <li><p><em>File decomposition and decompression</em> - Since ClamAV uses file decomposition and decompression to find viruses within de-archived and uncompressed inner files, YARA rules executed by ClamAV will match against these files as well.</p></li> <li><p><em>Normalization</em> - By default, ClamAV normalizes HTML, JavaScript, and ASCII text files. YARA rules in ClamAV will match against the normalized result. The effects of normalization of these file types may be captured using <code>clamscan --leave-temps --tempdir=mytempdir</code>. YARA rules may then be written using the normalized file(s) found in <code>mytempdir</code>. Alternatively, starting with ClamAV 0.100.0, <code>clamscan --normalize=no</code> will prevent normalization and only scan the raw file. To obtain similar behavior prior to 0.99.2, use <code>clamscan --scan-html=no</code>. The corresponding parameters for clamd.conf are <code>Normalize</code> and <code>ScanHTML</code>.</p></li> <li><p><em>YARA conditions driven by string matches</em> - All YARA conditions are driven by string matches in ClamAV. This saves from executing every YARA rule on every file. Any YARA condition may be augmented with a string match clause which is always true, such as:</p></li> </ul> <pre> rule CheckFileSize { strings: $abc = "abc" condition: ($abc or not $abc) and filesize < 200KB } </pre> <p>This will ensure that the YARA condition always performs the desired action (checking the file size in this example),</p> </body> </html>