yara-x 1.15.0

A pure Rust implementation of YARA.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

import "cuckoo"

rule checkip {
	condition:
	  cuckoo.network.http_request(/.*/) == 0
}

rule checkip_get {
	condition:
	  not cuckoo.network.http_get(/.*/)
}

rule checkip_post {
	condition:
	  not cuckoo.network.http_post(/.*/)
}

rule checkip_dns {
	condition:
	  not cuckoo.network.dns_lookup(/.*/)
}

rule user_agent {
	condition:
	  not cuckoo.network.http_user_agent(/.*/)
}

rule mutex {
	condition:
	  not cuckoo.sync.mutex(/.*/)
}

rule file_access {
	condition:
	  not cuckoo.filesystem.file_access(/.*/)
}

rule reg {
	condition:
      cuckoo.registry.key_access(/.*/) == 0
}