Usama Nathani
09/24/2020, 8:34 PMseph
09/24/2020, 11:32 PMUsama Nathani
09/25/2020, 2:35 PMMike Myers
09/26/2020, 3:41 AMUsama Nathani
09/27/2020, 5:30 PMAkshay Kumar
09/27/2020, 11:56 PMC:\Program Files\osquery\yara
)sig_group
from the yara rules. You will need to create the group in configuration and use them for scanning. https://osquery.readthedocs.io/en/stable/deployment/yara/Usama Nathani
09/28/2020, 2:29 AMAkshay Kumar
09/28/2020, 4:02 AMyara
directory if it is not there. The installer does not create it. You might be seeing parsing error because of the incorrect json format. Please add yara
as one of the top-level item and include signatures
defining groups inside it.Usama Nathani
09/28/2020, 4:28 PMAkshay Kumar
09/28/2020, 6:50 PMsigfile
or the absolute path name? The query should be like: select * from yara where path like '%' and sigfile='test.yara'
.C:\test
you are scanning is a file or directory? If you are scanning a directory you should use like
constraint. Let me know if it resolves scanning with sig_group
issue.