Title
#general
Usama Nathani

Usama Nathani

09/24/2020, 8:34 PM
Hi Guys! I wanted to ask if anyone knew whether on-demand YARA scanning was working for Windows since I've been trying to test it by creating a notepad file with a string and creating a rule in the same folder, however when I query it, "SELECT * FROM yara WHERE path=" U:\test" AND sig_group=" U:\test\new.yar";" , it doesnt work
s

seph

09/24/2020, 11:32 PM
What error do you get? Also, I'm not sure the yara table is on windows. It the error would make this clear.
Usama Nathani

Usama Nathani

09/25/2020, 2:35 PM
I get no output, just goes to next line. I can see the yara tables in windows when i use .tables or .schema yara
7:19 PM
I was finally able to run it however, I get this error:
7:19 PM
osquery> SELECT path, count from YARA where path='C:\test' AND sigfile='C:\test.txt'; W0925 12:18:50.504629 26284 yara.cpp:226] YARA compile error: Error loading YARA rules: 3
Mike Myers

Mike Myers

09/26/2020, 3:41 AM
Pinging @Akshay Kumar for when he gets back on Monday
3:42 AM
And yes it should be working in Windows so we'll have to figure out the problem
Usama Nathani

Usama Nathani

09/27/2020, 5:30 PM
Okay thank you. It was a simple test where I put the file in a new folder in C, notepad with 3 strings, and a rule in the same folder containing those strings with the condition: any of them
a

Akshay Kumar

09/27/2020, 11:56 PM
@Usama Nathani, You see the Yara compiler error because the rule file are not placed at the correct location. It should be at YaraHome (
C:\Program Files\osquery\yara
)
12:00 AM
Also, please follow the schema how to create the
sig_group
from the yara rules. You will need to create the group in configuration and use them for scanning. https://osquery.readthedocs.io/en/stable/deployment/yara/
Usama Nathani

Usama Nathani

09/28/2020, 2:29 AM
@Akshay Kumar Thank you for your quick reply. I wanted some further clarification. 1. Do we create a new folder for yara or is there supposed to be one already in osquery (cant find mine)? 2. Do we put the yara configuration (sig groups) in osquery.conf (got a parsing error) ?
a

Akshay Kumar

09/28/2020, 4:02 AM
You will need to create the
yara
directory if it is not there. The installer does not create it. You might be seeing parsing error because of the incorrect json format. Please add
yara
as one of the top-level item and include
signatures
defining groups inside it.
Usama Nathani

Usama Nathani

09/28/2020, 4:28 PM
I tried that, adding yara to top of congif file worked. I am still getting no output when i use this: SELECT path, count from YARA where path='C:\test' AND sig_group="sig_group_1";
4:29 PM
and I still get the same error as before when I use sig_file instead of sig_group after placing the files correctly/ updating configuration
a

Akshay Kumar

09/28/2020, 6:50 PM
I would like to confirm if you are providing the filename as
sigfile
or the absolute path name? The query should be like:
select * from yara where path like '%' and sigfile='test.yara'
.
6:58 PM
Also,
C:\test
you are scanning is a file or directory? If you are scanning a directory you should use
like
constraint. Let me know if it resolves scanning with
sig_group
issue.