Collector condition

[sirbrowser]

Hello Thiago,

Is it possible to execute a file collector based on the result of a command?

For example if I want to execute a yara scanner and collect all files flagged by the scanner.

Thanks

[tclahr]

Hi,
Yes, it is! You need to run yara scanner using command collector, save the list of files in a text file (one file per line), then collect them using the file collector.

Let me give you an example:

artifacts:
  -
    description: run yara scanner and save list of files in a text file
    supported_os: [all]
    collector: command
    command: yara_scanner <parameters>
    output_file: yara_scanner.txt
  -
    description: collect all files (full path) listed in yara_scanner.txt
    supported_os: [all]
    collector: file
    path: yara_scanner.txt
    is_file_list: true