Configuring YARA-X
Last updated
Last updated
Attention! YARA-X analysis is currently a beta/experimental feature in GuardMode. It is disabled by default and should be used with caution in production environments.
YARA-X is a powerful pattern matching tool used for malware classification and detection. In GuardMode, YARA-X analysis enhances file analysis capabilities alongside entropy and magic number checks.
YARA-X analysis is integrated into GuardMode's file analysis process. For scans, file integrity checks, and threshold analysis, GuardMode considers a file suspicious when:
It has high entropy combined with no identifiable magic numbers, or
It matches any YARA-X rules
In incident detection, files matching YARA-X rules are treated separately as potentially malicious.
By default, YARA-X analysis is disabled. To enable and configure it:
Add your YARA-X rule files to the YaraRules folder in the agent's installation directory.
Use the REST API to enable YARA-X analysis and configure rule paths.
To configure YARA-X analysis, use the following REST API endpoints:
Replace the path/to/... values with the actual paths to your YARA-X rule files for each analysis type.
To enable YARA-X for threshold analysis, use the /settings/threshold endpoint:
Include the following in your request body:
For file integrity checks, YARA-X analysis is controlled by the checkFileContents setting per path. Use the /settings/file-integrity endpoint:
Include the following in your request body:
To enable YARA-X analysis during on-demand scanning, you need to include the checkYaraRules parameter when initiating a scan. This is done through the /scans endpoint:
Include the following in your request body:
By setting checkYaraRules to true, you enable YARA-X analysis for the on-demand scan.
After modifying YARA-X rules or updating the configuration, restart the GuardMode agent to apply the changes:
On Linux:
On Windows:
YARA-X analysis time is proportional to the number of rules and the size of the file, unlike entropy and magic number checks, which take a fixed time regardless of file size.
YARA-X is typically used for malware detection rather than identifying encrypted files. While very large files are less likely to be malware, setting a reasonable maxFileSize can help balance detection capabilities with performance.
By leveraging YARA-X analysis alongside entropy and magic number checks, GuardMode provides a robust file analysis system to detect potential threats and suspicious activities in your environment.
Number of threshold buckets
Limit of data points to analyze
Scan creation request
Paths that will be recursively scanned
Indicates if file names found during scan should be analyzed to find files with names often used by ransomware
Indicates if files should be scanned using YARA rules
If true, Agent will raise alert on suspicious file found
If present, causes exclusions to work as if filesystem root was at each of provided paths
No content