IRFuzz : Simple Scanner with Yara Rules

IRFuzz is a simple scanner with yara rules for document archives or any files.

Install

1. Prerequisites

Linux or OS X

  • Yara: just use the latest release source code, compile and install it (or install it via pip install yara-python)
  • Yara Rules – You may download yara rules from here or import your own custom ruleset.
  • Python dependencies

Dependencies are managed with pipenv. To get started install dependencies and activate virtual environment with following commands:

$ pipenv install
$ pipenv shell

Running IRFuzz – Watchd

Running IRFuzz

$ python -m watchd.watch ~/tools/IR/ -y rules/maldocs --csv csvfile.csv

Supported Features

  • Scans new files with inotify
  • Polling if inotify is not supported
  • Custom extensions are supported
  • Delete mode will delete matched file
  • Recursive directory scan
  • Lists matched Yara functions with yarastrings with ctime
  • CSV results for Filebeat

Custom Extensions

$ python -m watchd.watch ~/tools/IR/ -y rules/maldocs --csv csvfile.csv --extensions .zip,.rar

Alert Matching Yara Rule

Generate token from https://irfuzz.com/tokens

$ python -m watchd.watch ~/tools/IR/ -y rules/maldocs --csv csvfile.csv --extensions .php --token tokenhere

Configure alerts from the website to Telegram or your email.

Delete Matched File

$ python -m watchd.watch ~/tools/IR/ -y rules/maldocs --csv csvfile.csv --delete

Polling (Inotify Not Supported)

$ python -m watchd.watch ~/tools/IR/ -y rules/maldocs --csv csvfile.csv --polling

Adds –poll option to force the use of polling mechanism to detect changes in data directory. Polling is slower than the underlying mechanism in OS to detect changes but it’s necessary with certain file systems such as SMB mounts.

  • Default Extensions If No Extensions Are Mentioned
    • Microsoft Office Word supported file formats
      • .doc .docm .docx .docx .dot .dotm .dotx .odt
    • Microsoft Office Excel supported file formats
      • .ods .xla .xlam .xls .xls .xlsb .xlsm .xlsx .xlsx .xlt .xltm .xltx .xlw
    • Microsoft Office PowerPoint supported file formats
      • .pot .potm .potx .ppa .ppam .pps .ppsm .ppsx .ppt .pptm .pptx .pptx .pptx
    • zipdump.py
R K

Recent Posts

Starship : Revolutionizing Terminal Experiences Across Shells

Starship is a powerful, minimal, and highly customizable cross-shell prompt designed to enhance the terminal…

21 hours ago

Lemmy : A Decentralized Link Aggregator And Forum For The Fediverse

Lemmy is an innovative, open-source platform designed for link aggregation and discussion, providing a decentralized…

21 hours ago

Massive UX Improvements, Custom Disassemblers, And MSVC Support In ImHex v1.37.0

The latest release of ImHex v1.37.0 introduces a host of exciting features and improvements, enhancing…

23 hours ago

Ghauri : A Powerful SQL Injection Detection And Exploitation Tool

Ghauri is a cutting-edge, cross-platform tool designed to automate the detection and exploitation of SQL…

1 day ago

Writing Tools : Revolutionizing The Art Of Writing

Writing tools have become indispensable for individuals looking to enhance their writing efficiency, accuracy, and…

1 day ago

PatchWerk : A Tool For Cleaning NTDLL Syscall Stubs

PatchWerk is a proof-of-concept (PoC) tool designed to clean NTDLL syscall stubs by patching syscall…

2 days ago