diff --git a/volatility3/framework/plugins/yarascan.py b/volatility3/framework/plugins/yarascan.py index b3c3acddf..ca8a91f84 100644 --- a/volatility3/framework/plugins/yarascan.py +++ b/volatility3/framework/plugins/yarascan.py @@ -58,6 +58,8 @@ class YaraScan(plugins.PluginInterface): description = "Yara rules (as a string)", optional = True), requirements.URIRequirement(name = "yara_file", description = "Yara rules (as a file)", optional = True), + # This additional requirement is to follow suit with upstream, who feel that compiled rules could potentially be used to execute malicious code + # As such, there's a separate option to run compiled files, as happened with yara-3.9 and later requirements.URIRequirement(name = "yara_compiled_file", description = "Yara compiled rules (as a file)", optional = True), requirements.IntRequirement(name = "max_size", default = 0x40000000,