steffenfritz / FileTrove

FileTrove indexes files and creates metadata from them.
https://filetrove.fritz.wtf
GNU Affero General Public License v3.0
32 stars 5 forks source link

[CHANGE] Add YARA support #82

Closed steffenfritz closed 4 months ago

steffenfritz commented 4 months ago

YARA is mostly used in malware detection and research.

However, it is also capable of searching for arbitrary strings, regexes, binary data patterns. It is extremely fast, especially the new Rust implementation YARA-X. YARA-X has first-citizen bindings for Go.

Including YARA to FileTrove adds a very powerful mechanism for finding and flagging files.

YARA rules should be provided via a file input flag during runtime.

https://virustotal.github.io/yara-x/blog/yara-is-dead-long-live-yara-x/ https://virustotal.github.io/yara-x/docs/api/go/