Windows: Clarify separate yara compiled method

2026-09-13 13:17:38 +02:00 · 2021-03-15 22:56:40 +00:00
parent c75bef2b05
commit 88bddbd596
1 changed files with 2 additions and 0 deletions
@@ -58,6 +58,8 @@ class YaraScan(plugins.PluginInterface):
                                           description = "Yara rules (as a string)",
                                           optional = True),
            requirements.URIRequirement(name = "yara_file", description = "Yara rules (as a file)", optional = True),
+            # This additional requirement is to follow suit with upstream, who feel that compiled rules could potentially be used to execute malicious code
+            # As such, there's a separate option to run compiled files, as happened with yara-3.9 and later
            requirements.URIRequirement(name = "yara_compiled_file", description = "Yara compiled rules (as a file)", optional = True),
            requirements.IntRequirement(name = "max_size",
                                        default = 0x40000000,