mirror of
https://github.com/adulau/scripts.git
synced 2024-05-20 15:22:13 +00:00
59 lines
1.2 KiB
Python
59 lines
1.2 KiB
Python
#!/usr/bin/python
|
|
#
|
|
# Generate Yara rules from a list of strings
|
|
|
|
import yara_tools
|
|
import yara
|
|
import argparse
|
|
import os
|
|
import fileinput
|
|
import sys
|
|
|
|
usage = "usage: %prog [options]"
|
|
|
|
parser = argparse.ArgumentParser(
|
|
description="Generate Yara rules from a list of strings", epilog=""
|
|
)
|
|
|
|
parser.add_argument(
|
|
"-n",
|
|
dest="name",
|
|
help="set name of the Yara rule",
|
|
type=str,
|
|
default="default_rule_name",
|
|
)
|
|
default_author = os.getlogin()
|
|
parser.add_argument(
|
|
"-a",
|
|
dest="author",
|
|
help="set name of the Yara rule author",
|
|
type=str,
|
|
default=default_author,
|
|
)
|
|
parser.add_argument(
|
|
"-p",
|
|
dest="purpose",
|
|
help="set the purpose of the Yara rule",
|
|
type=str,
|
|
default="Purpose not set",
|
|
)
|
|
|
|
options = parser.parse_args()
|
|
|
|
rule = yara_tools.create_rule(name=f'{options.name}', default_boolean='or')
|
|
rule.add_meta(key="author", value=f'{options.author}')
|
|
rule.add_meta(key="purpose", value=f'{options.purpose}')
|
|
|
|
s = []
|
|
for line in fileinput.input('-'):
|
|
l = line.rstrip()
|
|
if l:
|
|
s.append(l)
|
|
rule.add_strings(
|
|
strings=s, modifiers=['wide', 'ascii'], condition="any of ($IDENTIFIER*)"
|
|
)
|
|
|
|
generated_rule = rule.build_rule()
|
|
|
|
print(generated_rule)
|