You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When writing rules for systems that use old YARA binaries, setting a target YARA version (3.8.1 for signature-base) for a project would help ensure that rules do not include keywords (e.g., base64, xor), conditions (e.g., for any section in pe.sections : ( section.name == ".text" )), or modules (e.g., console) that are not supported.
Similar checks can be done with CI and yara-python before commit, but that does not facilitate rule writing.
The text was updated successfully, but these errors were encountered:
When writing rules for systems that use old YARA binaries, setting a target YARA version (3.8.1 for signature-base) for a project would help ensure that rules do not include keywords (e.g.,
base64
,xor
), conditions (e.g.,for any section in pe.sections : ( section.name == ".text" )
), or modules (e.g., console) that are not supported.Similar checks can be done with CI and yara-python before commit, but that does not facilitate rule writing.
The text was updated successfully, but these errors were encountered: