Is there a Yara daemon -- and if not, should there be? about awesome-yara

[admiralbenbou]

Hello. Didnt hear bout such daemons, but i met with similar problems in my old company and made a few tools based on Yara - mail transport agent for Exchange and Yara library that can process files and archives, which is used by windows service (not open-sourced) for scanning files and archives via Yara. Both of em you can see in this org and if you wish u can use something from this projects for your daemon, If you make such daemon, i think, it'd be wery useful

[Fneufneu]

Hi,
I'm looking for a yara daemon exactly like you describe @GWHAYWOOD,
did you find anything ?

[GWHAYWOOD]

Hi Fneufneu,

Sorry no, I never found anything. I only spent a few hours looking so I could have missed something.

It won't be difficult to do but unfortunately it's something like seventh or eighth on my TODO list.

Right now instead of using a daemon I write a file out to a RAM filesystem and scan that. It isn't hideously slow for scanning mail, on a slow machine typically around 60ms to write a mail file of a few tens of kbytes.

I wouldn't want to do it this way for scanning whole filesystems, especially if they contain large files, but I very rarely scan a filesystem.

HTH

Ged.

[dkorzhevin]

@GWHAYWOOD @Fneufneu https://docs.clamav.net/manual/Signatures/YaraRules.html

[GWHAYWOOD]

@dkorzhevin

Thanks for the link. I've used ClamAV for many years.

Unfortunately the Yara implementation in ClamAV is ten years out of date (roughly Yara version 2) and absolutely riddled with faults, some of which crash the ClamAV daemon. A couple of years ago I pointed this out to the ClamAV development people but they didn't seem interested.

As far as I'm aware there's been no change in ClamAV's Yara implementation since that time.

[JosiahRaySmith]

Perhaps an issue for https://github.com/VirusTotal/yara

[dkorzhevin]

@GWHAYWOOD Could you please reach out to me regarding the ClamAV faults and crashes, so I can try to reproduce with latest master?

dkorzhevin AT gmail DOT com