Skip to the content.

factual-rules-generator

Factual-rules-generator is an open source project which aims to generate YARA rules about installed software from a running operating system.

The goal of the software is to be able to use a set of rules against collected or acquired digital forensic evidences and find installed software in a timely fashion.

The software can be used to baseline known software from Windows system and create a set of rules for finding similar installation on other systems.

Dependencies

Tools requirement

Some tools are required on the host operating system some are Unix standard tools and some additional ones:

For the Windows virtual machine, the following software is required to be installed:

Install

In test/ some examples of software to install is given, the following specific format is required:

Run and generate the rules

Public YARA rules repository

Overview of factual rules generator

Factual rules generator - workflow

License

    Factual-rules-generator is an open source project which aims to generate YARA rules about installed software from a machine. 

    Copyright (C) 2021-2022 David Cruciani
    Copyright (C) 2021-2022 CIRCL - Computer Incident Response Center Luxembourg

    This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU Affero General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.

    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU Affero General Public License for more details.

    You should have received a copy of the GNU Affero General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.