Adding support for running YARA as sourcecode rules - Githubissues

DataDog / guarddog

:snake: :mag: GuardDog is a CLI tool to Identify malicious PyPI and npm packages

https://securitylabs.datadoghq.com/articles/guarddog-identify-malicious-pypi-packages/

Apache License 2.0

585 stars 43 forks source link

Adding support for running YARA as sourcecode rules #401

Closed sobregosodd closed 1 month ago

sobregosodd commented 2 months ago

This feature aims to provide support for running YARA rules also as sourcecode detection. What it does:

Import and compile all .yar files placed in guarddog/analyzer/sourcecode/ directory
Includes yara-python package and makes use of the binding to run selected rules to all files.

Another tasks addressed by this PR:

Re-add safari output tests cases
Remove (or heavily reduce) code hardcoded for ecosystem
- Refactor of SOURCECODE_RULES to hold generic rule type and ecosystem objects
- Remove click CLI ecosystem dependant and repeatable code