You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
APT34_PDB_path.yar: No rule name
jar_drops_9002.yar: Rule name illegal (starts with digit - "9002_DROPPER")
Emirates_Cred_Steal.yar: No identifier after colon ("rule EmiratesStatement : {")
crunchyroll.yar: Rule name illegal (has slashes - "rule CrunchyRoll_11/4/17{")
DMALocker4.0.yara: Rule name illegal (has period - "rule DMALocker4.0")
Satana_Ransomware.yara: No rule name before colon ("rule: Satana_Ransomware")
Vbs-Obfuscated.yara: Rule name illegal (has period - "rule Malware.Gen.Vbs.Obfuscated")
Destructive_Target_Cleaning_Tool_4.yar: Colon but no tag ("rule Destructive_Target_Cleaning_Tool_4:{")
blackhole2_htm4.yar: No rule name
apt_ProjectSauron_MyTrampoline.yar: "rrule" instead of "rule"
APT1_payloads.yar: "rivate rule" instead of "private rule"
kivars_service.yar: String name "SHA-256" illegal (no hyphens allowed in variable names)
madness.yar: Missing "meta:" before meta information
Logical errors:
billgates.yara - uses "IsElfFile" without adding 'include "IsElfFile.yara"'
ggupdate.yara - uses "IsElfFile" without adding 'include "IsElfFile.yara"'
libgcc.yara - uses "IsElfFile" without adding 'include "IsElfFile.yara"'
command_shell.yara - uses "IsPeFile" without adding 'include "IsPeFile.yara"'
conbot.yara - uses "IsPeFile" without adding 'include "IsPeFile.yara"'
emotet.yara - uses "IsPeFile" without adding 'include "IsPeFile.yara"'
ggupdate.yara - uses "IsPeFile" without adding 'include "IsPeFile.yara"'
hawkeye.yara - uses "IsPeFile" without adding 'include "IsPeFile.yara"'
nkh.yara - uses "IsPeFile" without adding 'include "IsPeFile.yara"'
scrtest.yara - uses "IsPeFile" without adding 'include "IsPeFile.yara"'
sqldb.yara - uses "IsPeFile" without adding 'include "IsPeFile.yara"'
viewweb.yara - uses "IsPeFile" without adding 'include "IsPeFile.yara"'
virtualbox_detection.yara - uses "IsPeFile" without adding 'include "IsPeFile.yara"'
APT1_aspnetreport.yar - uses "APT1_payloads" without adding 'include "alienvault_index.yara"'
Karagany.yar - uses "isPE" without adding 'include "IsPE.yar"'
The text was updated successfully, but these errors were encountered:
MrCrumbs
changed the title
List of Syntax errors in Yara rule files
List of errors in Yara rule files
Apr 1, 2019
Syntax errors:
APT34_PDB_path.yar: No rule name
jar_drops_9002.yar: Rule name illegal (starts with digit - "9002_DROPPER")
Emirates_Cred_Steal.yar: No identifier after colon ("rule EmiratesStatement : {")
crunchyroll.yar: Rule name illegal (has slashes - "rule CrunchyRoll_11/4/17{")
DMALocker4.0.yara: Rule name illegal (has period - "rule DMALocker4.0")
Satana_Ransomware.yara: No rule name before colon ("rule: Satana_Ransomware")
Vbs-Obfuscated.yara: Rule name illegal (has period - "rule Malware.Gen.Vbs.Obfuscated")
Destructive_Target_Cleaning_Tool_4.yar: Colon but no tag ("rule Destructive_Target_Cleaning_Tool_4:{")
blackhole2_htm4.yar: No rule name
apt_ProjectSauron_MyTrampoline.yar: "rrule" instead of "rule"
APT1_payloads.yar: "rivate rule" instead of "private rule"
kivars_service.yar: String name "SHA-256" illegal (no hyphens allowed in variable names)
madness.yar: Missing "meta:" before meta information
Logical errors:
billgates.yara - uses "IsElfFile" without adding 'include "IsElfFile.yara"'
ggupdate.yara - uses "IsElfFile" without adding 'include "IsElfFile.yara"'
libgcc.yara - uses "IsElfFile" without adding 'include "IsElfFile.yara"'
command_shell.yara - uses "IsPeFile" without adding 'include "IsPeFile.yara"'
conbot.yara - uses "IsPeFile" without adding 'include "IsPeFile.yara"'
emotet.yara - uses "IsPeFile" without adding 'include "IsPeFile.yara"'
ggupdate.yara - uses "IsPeFile" without adding 'include "IsPeFile.yara"'
hawkeye.yara - uses "IsPeFile" without adding 'include "IsPeFile.yara"'
nkh.yara - uses "IsPeFile" without adding 'include "IsPeFile.yara"'
scrtest.yara - uses "IsPeFile" without adding 'include "IsPeFile.yara"'
sqldb.yara - uses "IsPeFile" without adding 'include "IsPeFile.yara"'
viewweb.yara - uses "IsPeFile" without adding 'include "IsPeFile.yara"'
virtualbox_detection.yara - uses "IsPeFile" without adding 'include "IsPeFile.yara"'
APT1_aspnetreport.yar - uses "APT1_payloads" without adding 'include "alienvault_index.yara"'
Karagany.yar - uses "isPE" without adding 'include "IsPE.yar"'
The text was updated successfully, but these errors were encountered: