Sam at 16:57, 25 January 2021

2021-01-25T16:57:32Z

Sam at 16:57, 25 January 2021

2021-01-25T16:57:18Z

Sam: Created page with "{| style="float:right;border:1px solid black" |+ Details | Executable | `Archives.exe` |- | Stage | style="text-align:center;" | 6 |- | Percent Complete | style="te..."

2020-07-23T14:36:37Z

Created page with "{| style="float:right;border:1px solid black" |+ Details | Executable | <code>Archives.exe</code> |- | Stage | style="text-align:center;" | 6 |- | Percent Complete | style="te..."

New page

{| style="float:right;border:1px solid black"
|+ Details
| Executable
| <code>Archives.exe</code>
|-
| Stage
| style="text-align:center;" | 6
|-
| Percent Complete
| style="text-align:center;" | 48%
|-
| Message Queue
| <code>archives</code>
|}

Yara ETL uses the malware scanning tool called, well, [https://virustotal.github.io/yara/ YARA] to scan files.
When a [https://yara.readthedocs.io/en/stable/writingrules.html rule] hits, the file will be tagged with the name of the rule.
If any [https://yara.readthedocs.io/en/stable/writingrules.html#rule-tags tags] were specified in the YARA rule, they will also be applied to the file.

=File Types=
Yara scan the following types of files:

* [[Type_Parsable_MIME]]
* [[Type_PE]]
* [[Type_32bit_Windows_Executable]]
* [[Type_64bit_Windows_Executable]]
* [[Type_ROM_Windows_Executable]]
* [[Type_Adobe_PDF]]
* [[Type_XP_Prefetch]]
* [[Type_Vista7_Prefetch]]
* [[Type_TrueType_Font]]
* [[Type_DOS_Executable]]
* [[Type_TrueType_Font_Collection]]
* [[Type_OpenType_Font]]
* [[Type_Windows_Registry]]
* [[Type_SAM_Registry]]
* [[Type_System_Registry]]
* [[Type_Boot_Registry]]
* [[Type_User_Registry]]
* [[Type_Software_Registry]]
* [[Type_Xbox_Executable]]
* [[Type_Xbox_360_Executable]]
* [[Type_Windows_Event_Log]]
* [[Type_ELF_Executable]]
* [[Type_Android_Executable_35]]
* [[Type_Android_Executable_36]]
* [[Type_Windows_Registry_Fragment]]
* [[Type_Windows_XML_Event_Log]]
* [[Type_Obfuscated_TrueType_Font]]
* [[Type_Apple_Mach_O_Executable]]
* [[Type_81_Prefetch]]
* [[Type_LUA]]
* [[Type_XBE_Executable]]
* [[Type_Compressed_Prefetch]]
* [[Type_10_Prefetch]]

@@ Line 2: / Line 2: @@
 |+ Details
 | Executable
-| <code>Archives.exe</code>
+| <code>Yara.exe</code>
 |-
 | Stage

@@ Line 11: / Line 11: @@
 |-
 | Message Queue
-| <code>archives</code>
+| style="text-align:center;" | <code>yara</code>
 |}

Yara - Revision history

Sam at 16:57, 25 January 2021

Sam at 16:57, 25 January 2021

Sam: Created page with "{| style="float:right;border:1px solid black" |+ Details | Executable | Archives.exe |- | Stage | style="text-align:center;" | 6 |- | Percent Complete | style="te..."

Sam: Created page with "{| style="float:right;border:1px solid black" |+ Details | Executable | `Archives.exe` |- | Stage | style="text-align:center;" | 6 |- | Percent Complete | style="te..."