Configuring the Yara Scanner¶
FastFind, RegInfo and GetThis can use libyara to scan for matches on a disk.
- This scan can be configured with a
A typical XML line for a
<yara source="IOC.yara" block="2M" timeout="120" overlap="8192" />
Comma-separated or semicolon-separated list of yara files. This list can be actual file names or references to embedded resources or both. When specifying file names, the paths are relative to the folder from which the configured binary is executed.
When scanning files, the Yara engine can read them in blocks or as one big chunk of data. Available methods are:
blocksto read and scan files in blocks of size given by the block attribute, and
filemappingto read and scan files in one chunk using a pagefile-backed file mapping. This is not the same behavior as the
yarac.exebinary which uses a file-backed mapping implying a sharing lock on the file which would be hazardous during live system scanning.
filemapping value for this option is discouraged as it will consume a lot of memory for the scanning process when dealing with large files.
Integer specifying the size in bytes of the buffer Yara will use to scan each file. The following multipliers can be suffixed to this number: K, M, G (for kilobyte, megabyte and gigabyte respectively).
One should be aware that if a rule needs a file in its entirety to find a match (such as the Hash module or the
filesize variable), the size given by this attribute should be at least the file size or matches will become unreliable.
Integer specifying the size of the overlapping block created to scan for content that may match bytes in the region between two blocks. The following multipliers can be suffixed to this number: K, M, G (for kilobyte, megabyte and gigabyte respectively).
Number of seconds after which the Yara engine will abort a file scan. This limit applies to each file individually.