feat: add inline YARA rules support - #1164
Merged
Merged
Conversation
Collaborator
Author
|
should be merged after #1162 |
erickgalinkin
approved these changes
May 1, 2025
erickgalinkin
left a comment
Collaborator
There was a problem hiding this comment.
Looks good to me, thanks!
Pouyanpi
marked this pull request as ready for review
May 2, 2025 06:49
Pouyanpi
force-pushed
the
feat/inmemory-yara-rules
branch
from
May 2, 2025 06:53
4e065c8 to
7fcf74a
Compare
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## develop #1164 +/- ##
===========================================
+ Coverage 68.00% 68.03% +0.02%
===========================================
Files 161 161
Lines 15801 15813 +12
===========================================
+ Hits 10746 10758 +12
Misses 5055 5055
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
Pouyanpi
force-pushed
the
feat/inmemory-yara-rules
branch
from
May 2, 2025 12:31
7fcf74a to
037795c
Compare
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR Description by GH Copilot
This pull request refactors and enhances the injection detection module by improving configuration validation, supporting inline YARA rules, and adding new tests. The changes aim to make the code more modular, robust, and easier to extend.
Refactoring and Validation Improvements:
_validate_unpack_configtovalidate_injection_configand updated it to focus solely on validating the configuration without unpacking values. [1] [2]extract_injection_configto handle the extraction and processing of configuration values, separating concerns for better modularity.action_optionandyara_pathto ensure stricter checks and clearer error messages. [1] [2]Support for Inline YARA Rules:
yara_rulesdictionary in the configuration. This allows rules to be loaded directly from strings instead of files. [1] [2]load_rulesfunction to handle both file-based and inline rule sources.Test Suite Enhancements:
validate_injection_configandextract_injection_configfunctions. [1] [2]test_load_inline_yara_rules, to validate the functionality of inline YARA rules.Other Changes:
yara_pathoptional in theInjectionDetectionconfiguration and added the newyara_rulesfield._validate_unpack_configreferences across the codebase.