diff --git a/volatility3/framework/plugins/yarascan.py b/volatility3/framework/plugins/yarascan.py index 49db2af02..040a50c1a 100644 --- a/volatility3/framework/plugins/yarascan.py +++ b/volatility3/framework/plugins/yarascan.py @@ -182,7 +182,7 @@ class YaraScan(plugins.PluginInterface): rule = config["yara_string"] if rule[0] not in ["{", "/"]: rule = f'"{rule}"' - if config.get("case", False): + if config.get("insensitive", False): rule += " nocase" if config.get("wide", False): rule += " wide ascii"