yara-forge 0.1.0

A powerful Rust library for crafting, validating, and managing YARA rules
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50

//! Pre-defined templates for common YARA rule patterns
//! This module provides ready-to-use templates for various types of malware detection

use crate::RuleBuilder;
use chrono::Utc;

/// Template for creating a ransomware detection rule
pub fn ransomware_template(name: &str) -> RuleBuilder {
    RuleBuilder::new(name)
        .with_tag("malware")
        .with_tag("ransomware")
        .with_metadata("type", "ransomware")
        .with_metadata("created", &Utc::now().format("%Y-%m-%d").to_string())
}

/// Template for creating a cryptominer detection rule
pub fn cryptominer_template(name: &str) -> RuleBuilder {
    RuleBuilder::new(name)
        .with_tag("malware")
        .with_tag("cryptominer")
        .with_metadata("type", "cryptominer")
        .with_metadata("created", &Utc::now().format("%Y-%m-%d").to_string())
}

/// Template for creating a backdoor detection rule
pub fn backdoor_template(name: &str) -> RuleBuilder {
    RuleBuilder::new(name)
        .with_tag("malware")
        .with_tag("backdoor")
        .with_metadata("type", "backdoor")
        .with_metadata("created", &Utc::now().format("%Y-%m-%d").to_string())
}

/// Template for creating a generic malware detection rule
pub fn malware_template(name: &str, malware_type: &str) -> RuleBuilder {
    RuleBuilder::new(name)
        .with_tag("malware")
        .with_tag(malware_type)
        .with_metadata("type", malware_type)
        .with_metadata("created", &Utc::now().format("%Y-%m-%d").to_string())
}

/// Template for creating a filetype detection rule
pub fn filetype_template(name: &str, file_type: &str) -> RuleBuilder {
    RuleBuilder::new(name)
        .with_tag("filetype")
        .with_tag(file_type)
        .with_metadata("file_type", file_type)
        .with_metadata("created", &Utc::now().format("%Y-%m-%d").to_string())
}