yarAnalyzer - Yara Rule Analyzer and Statistics Generator
It creates statistics on a YARA rule set and files in a sample directory. Place some signatures with .yar extension in the “signatures” folder and then run yarAnalyzer on a certain sample directory.
Usage
usage: yarAnalyzer.py [-h] -p path [-s sigpath] [-e ext] [-i identifier]
[-m max-size] [-l max-string] [-f first-bytes] [--excel]
[--noempty] [--printAll] [--debug]
yarAnalyzer - Yara Rules Statistics and Analysis
optional arguments:
-h, --help show this help message and exit
-p path Path to scan
-s sigpath Path to signature files
-e ext signature extension
-i identifier Set an identifier - will be used in filename
identifier_rule_stats.csv and identifier_file_stats.csv
-m max-size Max file size in MB (default=10)
-l max-string Max filename/rulename string length in command line output
-f first-bytes Number of first bytes to show in output
--excel Add extras to suppress automatic conversion in Microsoft
Excel
--noempty Don't show empty values
--printAll Print all files that are scanned
--debug Debug output
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
usage: yarAnalyzer.py [-h] -p path [-s sigpath] [-e ext] [-i identifier]
[-m max-size] [-l max-string] [-f first-bytes] [--excel]
[--noempty] [--printAll] [--debug]
yarAnalyzer - Yara Rules Statistics and Analysis
optional arguments:
-h, --help show this help message and exit
-p path Path to scan
-s sigpath Path to signature files
-e ext signature extension
-i identifier Set an identifier - will be used in filename
identifier_rule_stats.csv and identifier_file_stats.csv
-m max-size Max file size in MB (default=10)
-l max-string Max filename/rulename string length in command line output
-f first-bytes Number of first bytes to show in output
--excel Add extras to suppress automatic conversion in Microsoft
Excel
--noempty Don't show empty values
--printAll Print all files that are scanned
--debug Debug output
You can download yarAnalyzer here:
