yara

Track YARA matches for files or PIDs.

Platform support

Please be aware that some queries can only be run against certain platforms. Below is a list of the supported platforms that this query supports. Zercurity will automatically pause queries from running if errors are detected. Running a query against an unsupported platform will result in the following error: no such table: yara

• Linux

• Mac OSX

Table schema

Name	Type	Description
path	TEXT	The path scanned
matches	TEXT	List of YARA matches
count	INTEGER	Number of YARA matches
sig_group	TEXT	Signature group used
sigfile	TEXT	Signature file used
strings	TEXT	Matching strings
tags	TEXT	Matching tags

Query examples

select * from yara where path = '/etc/passwd'

select * from yara where path LIKE '/etc/%'

select * from yara where path = '/etc/passwd' and sigfile = '/etc/osquery/yara/test.yara'