Comments (7)
Hello. Didnt hear bout such daemons, but i met with similar problems in my old company and made a few tools based on Yara - mail transport agent for Exchange and Yara library that can process files and archives, which is used by windows service (not open-sourced) for scanning files and archives via Yara. Both of em you can see in this org and if you wish u can use something from this projects for your daemon, If you make such daemon, i think, it'd be wery useful
from awesome-yara.
Hi,
I'm looking for a yara daemon exactly like you describe @GWHAYWOOD,
did you find anything ?
from awesome-yara.
Hi Fneufneu,
Sorry no, I never found anything. I only spent a few hours looking so I could have missed something.
It won't be difficult to do but unfortunately it's something like seventh or eighth on my TODO list.
Right now instead of using a daemon I write a file out to a RAM filesystem and scan that. It isn't hideously slow for scanning mail, on a slow machine typically around 60ms to write a mail file of a few tens of kbytes.
I wouldn't want to do it this way for scanning whole filesystems, especially if they contain large files, but I very rarely scan a filesystem.
HTH
Ged.
from awesome-yara.
@GWHAYWOOD @Fneufneu https://docs.clamav.net/manual/Signatures/YaraRules.html
from awesome-yara.
Thanks for the link. I've used ClamAV for many years.
Unfortunately the Yara implementation in ClamAV is ten years out of date (roughly Yara version 2) and absolutely riddled with faults, some of which crash the ClamAV daemon. A couple of years ago I pointed this out to the ClamAV development people but they didn't seem interested.
As far as I'm aware there's been no change in ClamAV's Yara implementation since that time.
from awesome-yara.
Perhaps an issue for https://github.com/VirusTotal/yara
from awesome-yara.
@GWHAYWOOD Could you please reach out to me regarding the ClamAV faults and crashes, so I can try to reproduce with latest master?
dkorzhevin AT gmail DOT com
from awesome-yara.
Related Issues (14)
- Add bartblaze Yara-rules HOT 1
- todo: resolve link issues
- ELAT HOT 1
- some suggestions HOT 3
- Add: YAIDS
- Add https://yara.adlice.com/ YaraShare project HOT 1
- Add: Yara Scan HOT 1
- Elastic Yara rules HOT 1
- Resources on a wide range of topics HOT 1
- What happened to androguard? HOT 3
- Consider adding FARA: Faux Yara HOT 3
- Add this open source antivirus project which uses YARA and supports YARA-X HOT 1
- Add deadbits yara-rules repo HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from awesome-yara.