Closed abusech closed 15 hours ago
They all already target RTF files only as explicitly specified in the condition with uint32(0) == 0x74725c7b
. I don't disagree with you when it comes to these rules performance. But due to the wide variations of evasion manipulations they grew into performance hogs, otherwise, they would result in false negatives. I will take a look.
These rules have been disabled and should be enabled on-demand in ea8952882072084aae9128e9711947fd680dbe28.
It appears that the following YARA rules have a poor quality:
As a matter of fact, it seems that they are too wide causing massive slow down in YARA scanning performance:
Sadly, these rules caused service degradation of YARAify. We therefore had to remove your ruleset from our service.
Would it be possible to fix these rules and make them more specific (e.g. by looking explicitly for RTF files)?