Hi Guys! I wanted to ask if anyone knew whether on...
# general
Hi Guys! I wanted to ask if anyone knew whether on-demand YARA scanning was working for Windows since I've been trying to test it by creating a notepad file with a string and creating a rule in the same folder, however when I query it, "*SELECT* * FROM yara WHERE path=" U:\test" AND sig_group=" U:\test\new.yar";" , it doesnt work
What error do you get? Also, I'm not sure the yara table is on windows. It the error would make this clear.
I get no output, just goes to next line. I can see the yara tables in windows when i use .tables or .schema yara
I was finally able to run it however, I get this error:
osquery> SELECT path, count from YARA where path='C:\test' AND sigfile='C:\test.txt'; W0925 121850.504629 26284 yara.cpp:226] YARA compile error: Error loading YARA rules: 3
Pinging @Akshay Kumar for when he gets back on Monday
And yes it should be working in Windows so we'll have to figure out the problem
Okay thank you. It was a simple test where I put the file in a new folder in C, notepad with 3 strings, and a rule in the same folder containing those strings with the condition: any of them
@Usama Nathani, You see the Yara compiler error because the rule file are not placed at the correct location. It should be at YaraHome (
C:\Program Files\osquery\yara
Also, please follow the schema how to create the
from the yara rules. You will need to create the group in configuration and use them for scanning. https://osquery.readthedocs.io/en/stable/deployment/yara/
@Akshay Kumar Thank you for your quick reply. I wanted some further clarification. 1. Do we create a new folder for yara or is there supposed to be one already in osquery (cant find mine)? 2. Do we put the yara configuration (sig groups) in osquery.conf (got a parsing error) ?
You will need to create the
directory if it is not there. The installer does not create it. You might be seeing parsing error because of the incorrect json format. Please add
as one of the top-level item and include
defining groups inside it.
I tried that, adding yara to top of congif file worked. I am still getting no output when i use this: SELECT path, count from YARA where path='C:\test' AND sig_group="sig_group_1";
and I still get the same error as before when I use sig_file instead of sig_group after placing the files correctly/ updating configuration
I would like to confirm if you are providing the filename as
or the absolute path name? The query should be like:
select * from yara where path like '%' and sigfile='test.yara'
you are scanning is a file or directory? If you are scanning a directory you should use
constraint. Let me know if it resolves scanning with