[Bro] Bro + Yara File Scanning Module?

[Mike Reeves]

The process I use is I have all of the files being written to a directory then a python scripts monitors that for new files. It uses a Redis keystore and checks the sha256 of the file. If it exists in the keystore it simply deletes the file and moves on. If it does not exist it adds it to the keystore and then moves it somewhere else. This could be Yara or whatever. I will see if I can dig it up but it was rather simple python. I did this because I didn’t want to tie up Bro especially if you are seeing high file volume.

Mike

On Jul 25, 2014, at 10:03 AM, Jason Batchelor <jxbatchelor at gmail.com> wrote:

> Hello all:
>  
> I wanted to poke the hive mind to see if anyone has considered, or is actively pursuing integrating Yara into a Bro script?
>  
> An idea for a script I would like to write is to simply take any file from a 'file_new' event. Then add something like Files::ANALYZER_YARA that would do the heavy lifting and take a user defined path to a master Yara file, scan the file, append the results to either files.log or notice.log, and finally, extract any file that hit on a signature (for further analysis).
>  
> Interested if this is something that has been considered previously? If so, what were the results? If not, I'm happy to spin off an effort of my own. Either way I see it as a good project to get into Bro scripting at a deeper level.
>  
> Thanks,
> Jason
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro