Malware Scanner

A command-line tool that scans files for malware patterns using custom detection rules.

Capabilities

File Scanning

Scan individual files on disk for malware patterns using predefined detection rules. The scanner should load YARA rules from a rules file and apply them to target files, reporting any matches found.

• Scanning an existing text file with a simple rule that matches the string "MALWARE" returns a match with the rule name @test
• Scanning a file that doesn't match any rules returns an empty list of matches @test
• Scanning a non-existent file raises an appropriate error @test

Rule Compilation from File

Load and compile detection rules from a YARA rules file. The rules file contains pattern definitions that describe malicious characteristics to detect.

• Compiling rules from a valid YARA rules file succeeds and returns a Rules object @test
• Attempting to compile rules from a non-existent file raises an error @test
• Attempting to compile a rules file with syntax errors raises a compilation error @test

Match Result Reporting

Extract and report detailed information about pattern matches, including which rules matched and what specific patterns were found in the scanned files.

• A match result includes the rule name that was triggered @test
• A match result provides access to the matched string identifiers @test

Multiple File Scanning

Scan multiple files in a single operation, reporting matches for each file individually. This allows efficient batch scanning of multiple suspicious files.

• Scanning three files where two match rules and one doesn't returns matches only for the two matching files @test
• Scanning multiple files where all match returns matches for all files @test

Implementation

@generates

API

def compile_rules(rules_path: str):
    """
    Compile YARA rules from a file.

    Args:
        rules_path: Path to the YARA rules file

    Returns:
        Compiled rules object ready for scanning

    Raises:
        Exception: If the file doesn't exist or contains invalid rules
    """
    pass

def scan_file(rules, file_path: str) -> list:
    """
    Scan a single file using compiled rules.

    Args:
        rules: Compiled YARA rules object
        file_path: Path to the file to scan

    Returns:
        List of match objects (empty list if no matches)

    Raises:
        Exception: If the file doesn't exist
    """
    pass

def scan_files(rules, file_paths: list) -> dict:
    """
    Scan multiple files using compiled rules.

    Args:
        rules: Compiled YARA rules object
        file_paths: List of file paths to scan

    Returns:
        Dictionary mapping file paths to lists of match objects

    Raises:
        Exception: If any file doesn't exist
    """
    pass

def get_match_info(match) -> dict:
    """
    Extract information from a match object.

    Args:
        match: A YARA match object

    Returns:
        Dictionary containing 'rule_name' and 'string_identifiers' keys
    """
    pass

Dependencies { .dependencies }

yara-python { .dependency }

Provides pattern matching support for malware detection.

@satisfied-by