zahida naeem

08/28/2022, 12:58 PM
Hi,I am performing malware detection using yara this is my config file
"options": {
"config_plugin": "filesystem",
"logger_plugin": "filesystem",
"logger_path": "/var/log/osquery",
"logger_snapshot_event_type": "true",
"schedule_splay_percent": "10"
"yara": {
"signatures": {
// Each key is an arbitrary group name to give the signatures listed
"sig_group_1": [ "/home/slyb/yara_rules/hello_worlds.yar" ]
// "sig_group_2": [ "/Users/wxs/sigs/baz.yar" ]
"file_paths": {
"system_binaries": [ "sig_group_1" ]
// Paths to watch for filesystem events
"file_paths": {
"system_binaries": [ "/home/slyb/%" ]
"packs": {
"osquery-monitoring": "/home/slyb/osquery/packs/osquery-monitoring.conf",
"fim": "/home/slyb/osquery/packs/fim.conf"
and this is my flag file
this is my yara rule file
rule ExampleRule
$my_text_string = "hello world"
$my_hex_string = { E2 34 A1 C8 23 FB }
$my_text_string or $my_hex_string
the problem is im getting no entry in yara_events table after testing for a file that has the same signature as mentioned in yara rule
1:08 PM
osquery detecting file_events but not detecting yara events
1:08 PM
what could be the reason
Kathy Satterlee

Kathy Satterlee

08/29/2022, 2:30 PM
Hi, @zahida naeem! Where is your test file located?
2:31 PM
And was the file created/changed after yara scanning was set up?