We should have a collection of default YARA rules as .yaml files. These would do useful things like:
- Tagging events (e.g. login pages)
- Raising findings (e.g. verbose errors / serialized objects)
Basically, any rules that are simple enough to express in YAML, we should keep as separate files so they're more easily maintainable and don't take up space in excavate.py.
@liquidsec
We should have a collection of default YARA rules as
.yamlfiles. These would do useful things like:Basically, any rules that are simple enough to express in YAML, we should keep as separate files so they're more easily maintainable and don't take up space in
excavate.py.@liquidsec