YaraMatcher karton服务

使用yara规则扫描分析和样本，并使用适当的标签生成任务。

作者: CERT.pl

维护者: nazywam

消耗

{
    "type": "sample",
    "stage": "recognized",
    "kind": "runnable"
}, {
    "type": "sample",
    "stage": "recognized",
    "kind": "dump"
}, {
    "type": "analysis",
    "kind": "cuckoo1"
}, {
    "type": "analysis",
    "kind": "drakrun"
}, {
    "type": "analysis",
    "kind": "joesandbox"
}

产生

{
    "type": "sample",
    "stage": "analyzed"
}

用法

首先，确保您已设置好核心系统： https://github.com/CERT-Polska/karton

然后从PyPi安装karton-yaramatcher

$ pip install karton-yaramatcher

并通过指向您的YARA规则仓库来运行karton服务

$ karton-yaramatcher --rules yara_rule_directory