Skip to content

Commit

Permalink
doc: Clarifies clava <-> yara usage with a better example.
Browse files Browse the repository at this point in the history
  • Loading branch information
strfx authored Oct 8, 2021
1 parent c4649b9 commit 0518412
Showing 1 changed file with 10 additions and 7 deletions.
17 changes: 10 additions & 7 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -65,13 +65,16 @@ and / or corpus of samples. The binaries can be downloaded from [here](https://v

For example:
```sh
# Generate a rule and store it in a file
$ clava yara <path/to/sample> -o myrule.yar
# Apply the yara rule on a directory
$ yara myrule.yar my-malware-corpus/
# Compile the yara rule for better performance
$ yarac myrule.yar myrule-compiled
$ yara -C myrule-compiled my-malware-corpus/
# Create yara rule 'detect-evil.yara' for evil.exe:
$ clava yara evil.exe -o detect-evil.yar

# Check if any file in a corpus matches the generated rule:
$ yara detect-evil.yar my-malware-corpus/

# Tip: If you have a large corpus, you can compile the yara rule to
# increase the performance:
$ yarac detect-evil.yar detect-evil-compiled
$ yara -C detect-evil-compiled my-malware-corpus/
```

**Important:** Rules created with clava should **not** directly be used in production, but can assist during rule development. This project is heavily inspired by [yarGen](https://github.com/Neo23x0/yarGen), therefore see also Floriah Roth's [blog post](https://cyb3rops.medium.com/how-to-post-process-yara-rules-generated-by-yargen-121d29322282) *"How to post-process YARA rules generated by yarGen"*.
Expand Down

0 comments on commit 0518412

Please sign in to comment.