Giters

evild3ad / MemProcFS-Analyzer

MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR

Home Page:https://lethal-forensics.com

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Feature Request - Automated rule download from Yara Forge

BIitzkrieg opened this issue · comments

commented

I'd like to propose adding to the Get-YaraCustomRules function to pull the latest Yara Forge ruleset (https://github.com/YARAHQ/yara-forge/releases/), or set up a job to sync this ruleset to your defined repo at https://github.com/evild3ad/yara/. This should greatly extend the library of Yara rules for scanning with this tool. Thank you for your work on this!

commented

Thanks for the feature request. I will check out the yara-forge ruleset. Usually I add only yara rules which are for scanning memory.

commented

Sorry. I don't see a practical way to include this YARA ruleset. Yara Forge includes rules for Linux and macOS (not supported by MemProcFS) and most of the rules are for scanning files or the scan context is unknown.