IRFuzz : Simple Scanner with Yara Rules

IRFuzz is a simple scanner with yara rules for document archives or any files.

Install

1. Prerequisites

Linux or OS X

  • Yara: just use the latest release source code, compile and install it (or install it via pip install yara-python)
  • Yara Rules – You may download yara rules from here or import your own custom ruleset.
  • Python dependencies

Dependencies are managed with pipenv. To get started install dependencies and activate virtual environment with following commands:

$ pipenv install
$ pipenv shell

Running IRFuzz – Watchd

Running IRFuzz

$ python -m watchd.watch ~/tools/IR/ -y rules/maldocs --csv csvfile.csv

Supported Features

  • Scans new files with inotify
  • Polling if inotify is not supported
  • Custom extensions are supported
  • Delete mode will delete matched file
  • Recursive directory scan
  • Lists matched Yara functions with yarastrings with ctime
  • CSV results for Filebeat

Custom Extensions

$ python -m watchd.watch ~/tools/IR/ -y rules/maldocs --csv csvfile.csv --extensions .zip,.rar

Alert Matching Yara Rule

Generate token from https://irfuzz.com/tokens

$ python -m watchd.watch ~/tools/IR/ -y rules/maldocs --csv csvfile.csv --extensions .php --token tokenhere

Configure alerts from the website to Telegram or your email.

Delete Matched File

$ python -m watchd.watch ~/tools/IR/ -y rules/maldocs --csv csvfile.csv --delete

Polling (Inotify Not Supported)

$ python -m watchd.watch ~/tools/IR/ -y rules/maldocs --csv csvfile.csv --polling

Adds –poll option to force the use of polling mechanism to detect changes in data directory. Polling is slower than the underlying mechanism in OS to detect changes but it’s necessary with certain file systems such as SMB mounts.

  • Default Extensions If No Extensions Are Mentioned
    • Microsoft Office Word supported file formats
      • .doc .docm .docx .docx .dot .dotm .dotx .odt
    • Microsoft Office Excel supported file formats
      • .ods .xla .xlam .xls .xls .xlsb .xlsm .xlsx .xlsx .xlt .xltm .xltx .xlw
    • Microsoft Office PowerPoint supported file formats
      • .pot .potm .potx .ppa .ppam .pps .ppsm .ppsx .ppt .pptm .pptx .pptx .pptx
    • zipdump.py
R K

Recent Posts

WID_LoadLibrary : The Intricacies Of DLL Management In Windows

WID_LoadLibrary is a custom implementation inspired by the Windows API function LoadLibrary, which is used…

14 hours ago

Locksmith : A Tool For Securing Active Directory Certificate Services

Locksmith is a specialized tool designed to identify and remediate vulnerabilities in Active Directory Certificate…

14 hours ago

Uscrapper Vanta : A Cutting-Edge OSINT Tool For Advanced Data Extraction

Uscrapper Vanta is a powerful open-source intelligence (OSINT) tool designed to revolutionize web scraping and…

14 hours ago

Pake : Transforming Webpages Into Desktop Applications

Pake is an innovative tool designed to convert any webpage into a desktop application with…

19 hours ago

Bevy : Exploring The Frontier Of Game Development With Rust

Bevy is an open-source, data-driven game engine built in Rust, designed to simplify game development…

19 hours ago

AppFlowy Cloud : Enhancing Collaboration With Secure Cloud Infrastructure

AppFlowy Cloud is a robust component of the AppFlowy ecosystem, designed to provide secure user…

2 days ago