diff --git a/index.rst b/index.rst index 64c16a8..606967b 100644 --- a/index.rst +++ b/index.rst @@ -22,6 +22,7 @@ THOR Util User Manual usage/log-conversion usage/templates usage/diagnostics + usage/yara-forge Indices and tables diff --git a/usage/yara-forge.rst b/usage/yara-forge.rst new file mode 100644 index 0000000..4d491db --- /dev/null +++ b/usage/yara-forge.rst @@ -0,0 +1,31 @@ +YARA Forge +=========== + +YARA-Forge (https://yarahq.github.io/) is an open source project that +bundles YARA rules from different open source projects. Rules are offered +in different **rulesets** that differ in their FP ratio / detection rate tradeoff. + +THOR Util offers support for downloading YARA Forge with: + +.. code:: doscon + + C:\thor>thor-util.exe yara-forge download --ruleset + +Where **ruleset** can be one of the following: + +- core +- extended +- full + +.. note:: + Only one ruleset at a time can be used. When you download a new + ruleset, the old one gets overwritten. + +A downloaded YARA Forge ruleset is stored in ``custom-signatures/yara-forge`` +and is automatically updated with ``thor-util update``. + +If you no longer want to use YARA Forge, you can run: + +.. code:: doscon + + C:\thor>thor-util.exe yara-forge remove