fibratus icon indicating copy to clipboard operation
fibratus copied to clipboard

Implement `scan_proc` and `scan_file` filament functions

Open rabbitstack opened this issue 5 years ago • 0 comments

These functions would cooperate with the Yara scanner to trigger rule execution within the filament. The functions should return which rules and strings were matched along with other useful information.

This functionality would be especially beneficial for enriching certain analyses. For example, it would be possible to scan the process only after a particular condition is met in the filament code.

rabbitstack avatar Jan 05 '21 16:01 rabbitstack