> For the complete documentation index, see [llms.txt](https://manuals.blusapphire.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://manuals.blusapphire.io/blugenie/full-function-list/invoke-blugenieyara.md). # Invoke-BluGenieYara ### Invoke-BluGenieYara ### SYNOPSIS Yara Scanner ### SYNTAX ``` Invoke-BluGenieYara [[-ItemToScan] ] [-Rules ] [-RulesSource ] [-CompiledRules] [-ToolPath ] [-Count] [-Tag ] [-Identifier ] [-Negate] [-PrintTags] [-PrintMeta] [-MaxStringsPerRule ] [-PrintStrings] [-PrintStats] [-PrintNamespace] [-Threads ] [-PrintStringLength ] [-MaxRules ] [-Timeout ] [-Recurse] [-FastScan] [-StasckSize ] [-FailOnWarnings] [-NoWarnings] [-Version] [-CommandHelp] [-ClearGarbageCollecting] [-UseCache] [-CachePath ] [-RemoveCache] [-DBName ] [-DBPath ] [-UpdateDB] [-ForceDBUpdate] [-NewDBTable] [-Walkthrough] [-ReturnObject] [-OutUnEscapedJSON] [-OutYaml] [-FormatView ] [] ``` ### DESCRIPTION Invoke-BluGenieYara is a wrapper around the YARA tool. The Yara tools is designed to help malware researchers identify and classify malware samples. It’s been called the pattern-matching Swiss Army knife for security researchers (and everyone else). ### EXAMPLES #### EXAMPLE 1 ``` Command: Invoke-BluGenieYara -ItemToScan $env:TEMP ``` ``` Description: Scan all files under $env:temp directory with any .Yar rules found Notes: ``` #### EXAMPLE 2 ``` Command: Invoke-BluGenieYara -ItemToScan $env:TEMP -Recurse ``` ``` Description: Recursive Directory Scan Notes: ``` #### EXAMPLE 3 ``` Command: Invoke-BGYara -ItemToScan $env:TEMP -Recurse ``` ``` Description: Use the (BG) Alias to run Yara Notes: ``` #### EXAMPLE 4 ``` Command: Yara -ItemToScan $env:TEMP -Recurse ``` ``` Description: Use the Short Name Alias to run Yara scan Notes: ``` #### EXAMPLE 5 ``` Command: Invoke-BluGenieYara -ItemToScan "$env:TEMP\AttachmentArchive.msg" -Rules 'Attachment' ``` ``` Description: Run all Rules with Attachment in the name against the .MSG file in the temp direcotry Notes: ``` #### EXAMPLE 6 ``` Command: Invoke-BluGenieYara -ItemToScan "$env:TEMP\AttachmentArchive.msg" -Rules 'Attachment' -RulesSource Z:\YaraRules\Email ``` ``` Description: Run all Rules with Attachment in the name from a specific source, against the .MSG file in the temp direcotry Notes: ``` #### EXAMPLE 7 ``` Command: Invoke-BluGenieYara -ItemToScan $(Get-Process -Name notepad++ | Select-Object -ExpandProperty ID) ``` ``` Description: Scan a PID Notes: ``` #### EXAMPLE 8 ``` Command: Invoke-BluGenieYara -ItemToScan 'AllPids' ``` ``` Description: Scan all PID using all found .Yar rules Notes: ``` #### EXAMPLE 9 ``` Command: Invoke-BluGenieYara -ItemToScan $env:TEMP -UseCache ``` ``` Description: Cache found objects to disk to not over tax Memory resources Notes: By default the Cache location is %SystemDrive%\Windows\Temp ``` #### EXAMPLE 10 ``` Command: Invoke-BluGenieYara -ItemToScan $env:TEMP -UseCache -RemoveCache ``` ``` Description: Remove Cache data Notes: By default the Cache information is removed right before the data is returned to the caller ``` #### EXAMPLE 11 ``` Command: Invoke-BluGenieYara -ItemToScan $env:TEMP -UseCache -CachePath $Env:Temp ``` ``` Description: Change the Cache path to the current users Temp directory Notes: By default the Cache location is %SystemDrive%\Windows\Temp ``` #### EXAMPLE 12 ``` Command: Invoke-BluGenieYara -ItemToScan $env:TEMP -UseCache -ClearGarbageCollecting ``` ``` Description: Scan large directories and limit the memory used to track data Notes: ``` #### EXAMPLE 13 ``` Command: Invoke-BluGenieYara -Help ``` ``` Description: Call Help Information Notes: If Help / WalkThrough is setup as a parameter, this script will be called to setup the Dynamic Help Menu if not the normal Get-Help will be called with the -Full parameter ``` #### EXAMPLE 14 ``` Command: Invoke-BluGenieYara -WalkThrough ``` ``` Description: Call Help Information [2] Notes: If Help / WalkThrough is setup as a parameter, this script will be called to setup the Dynamic Help Menu if not the normal Get-Help will be called with the -Full parameter ``` #### EXAMPLE 15 ``` Command: Invoke-BluGenieYara -ItemToScan $env:TEMP -OutUnEscapedJSON ``` ``` Description: Return a detailed function report in an UnEscaped JSON format Notes: The OutUnEscapedJSON is used to Beautify the JSON return and not Escape any Characters. Normal return data is a Hash Table. ``` #### EXAMPLE 16 ``` Command: Invoke-BluGenieYara -ItemToScan $env:TEMP -OutYaml ``` ``` Description: Return a detailed function report in YAML format Notes: The OutUnEscapedJSON is used to Beautify the JSON return and not Escape any Characters. Normal return data is a Hash Table. ``` #### EXAMPLE 17 ``` Command: Invoke-BluGenieYara -ItemToScan $env:TEMP -ReturnObject ``` ``` Description: Return Output as a Object Notes: The ReturnObject is used to return a PowerShell Object. Normal return data is a Hash Table. This parameter is also used with the FormatView ``` #### EXAMPLE 18 ``` Command: Invoke-BluGenieYara -ItemToScan $env:TEMP -ReturnObject -FormatView Yaml ``` ``` Description: Output PSObject information in Yaml format Notes: Current formats supported by default are ('Table','Custom','CustomModified','None','JSON','OutUnEscapedJSON','CSV', 'Yaml') Default is set to (None) and normal PSObject. ``` ### PARAMETERS #### ItemToScan ``` -ItemToScan Description: File(s), Directory, PID, or AllPids Scan Notes: If ItemToScan = "AllPids", every PID on the System will be scanned Alias: ValidateSet: Required? false Position? 1 Default value Accept pipeline input? false Accept wildcard characters? false ``` #### Rules ``` -Rules Description: .Yar Rule Names (Filtered with RegEx) Notes: Default is set to '.*' Alias: ValidateSet: Required? false Position? named Default value .* Accept pipeline input? false Accept wildcard characters? false ``` #### RulesSource ``` -RulesSource Description: Source path to for your .Yar Rule files Notes: Default Search Paths * $Env:SystemDrive\Windows\Temp * %Current Script Directory% * $Env:Temp This scan is not recursive. Alias: ValidateSet: Required? false Position? named Default value Accept pipeline input? false Accept wildcard characters? false ``` #### CompiledRules ``` -CompiledRules [] Description: Load compiled rules Notes: Alias: 'CR' ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### ToolPath ``` -ToolPath Description: Notes: Default is set to $('{0}\Windows\Temp' -f $env:SystemDrive) Alias: ValidateSet: Required? false Position? named Default value $(Join-Path -Path $ToolsDirectory -ChildPath 'Yara') Accept pipeline input? false Accept wildcard characters? false ``` #### Count ``` -Count [] Description: Print only number of matches Notes: Alias: 'C' ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### Tag ``` -Tag Description: Print only rules tagged as TAG Notes: tag=TAG Alias: 'T' ValidateSet: Required? false Position? named Default value Accept pipeline input? false Accept wildcard characters? false ``` #### Identifier ``` -Identifier Description: Print only rules named IDENTIFIER Notes: identifier=IDENTIFIER Alias: 'I' ValidateSet: Required? false Position? named Default value Accept pipeline input? false Accept wildcard characters? false ``` #### Negate ``` -Negate [] Description: Print only not satisfied rules (negate) Notes: Alias: 'N' ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### PrintTags ``` -PrintTags [] Description: Print tags Notes: Alias: 'PT' ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### PrintMeta ``` -PrintMeta [] Description: Print metadata Notes: Alias: 'PM' ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### MaxStringsPerRule ``` -MaxStringsPerRule Description: Set maximum number of strings per rule (default=10000) Notes: Alias: 'MS' ValidateSet: Required? false Position? named Default value 0 Accept pipeline input? false Accept wildcard characters? false ``` #### PrintStrings ``` -PrintStrings [] Description: Print matching strings Notes: Alias: 'PS' ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### PrintStats ``` -PrintStats [] Description: Print rules' statistics Notes: Alias: 'PA' ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### PrintNamespace ``` -PrintNamespace [] Description: Print rules' namespace Notes: Alias: 'PN' ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### Threads ``` -Threads Description: Use the specified NUMBER of threads to scan a directory Notes: Alias: 'TR' ValidateSet: Required? false Position? named Default value 0 Accept pipeline input? false Accept wildcard characters? false ``` #### PrintStringLength ``` -PrintStringLength Description: Print length of matched strings Notes: Alias: 'PL' ValidateSet: Required? false Position? named Default value 0 Accept pipeline input? false Accept wildcard characters? false ``` #### MaxRules ``` -MaxRules Description: Abort scanning after matching a NUMBER of rules Notes: Alias: 'M' ValidateSet: Required? false Position? named Default value 0 Accept pipeline input? false Accept wildcard characters? false ``` #### Timeout ``` -Timeout Description: Abort scanning after the given number of SECONDS Notes: Alias: 'TO' ValidateSet: Required? false Position? named Default value 0 Accept pipeline input? false Accept wildcard characters? false ``` #### Recurse ``` -Recurse [] Description: Recursively search directories (follows symlinks) Notes: Alias: 'R' ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### FastScan ``` -FastScan [] Description: Fast matching mode Notes: Alias: 'F' ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### StasckSize ``` -StasckSize Description: Set maximum stack size (default=16384) Notes: Alias: 'SS' ValidateSet: Required? false Position? named Default value 0 Accept pipeline input? false Accept wildcard characters? false ``` #### FailOnWarnings ``` -FailOnWarnings [] Description: Fail on warnings Notes: Alias: 'FW' ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### NoWarnings ``` -NoWarnings [] Description: Disable warnings Notes: Alias: 'NW' ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### Version ``` -Version [] Description: Show version information Notes: Alias: 'V' ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### CommandHelp ``` -CommandHelp [] Description: Show the Yara command help Notes: Alias: 'CH' ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### ClearGarbageCollecting ``` -ClearGarbageCollecting [] Description: Garbage Collection in Powershell to Speed up Scripts and help lower memory consumption Notes: This is enabled by default. To disable use -ClearGarbageCollecting:$False Alias: ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### UseCache ``` -UseCache [] Description: Cache found objects to disk. This is to not over tax Memory resources with found artifacts Notes: By default the Cache location is %SystemDrive%\Windows\Temp Alias: ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### CachePath ``` -CachePath Description: Path to store the Cache information Notes: By default the Cache location is %SystemDrive%\Windows\Temp Alias: ValidateSet: Required? false Position? named Default value $('{0}\Windows\Temp\{1}.log' -f $env:SystemDrive, $(New-BluGenieUID)) Accept pipeline input? false Accept wildcard characters? false ``` #### RemoveCache ``` -RemoveCache [] Description: Remove Cache data on completion Notes: Cache information is removed right before the data is returned to the calling process Alias: ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### DBName ``` -DBName Description: Database Name (Without extention) Notes: The default name is set to 'BluGenie' Alias: ValidateSet: Required? false Position? named Default value BluGenie Accept pipeline input? false Accept wildcard characters? false ``` #### DBPath ``` -DBPath Description: Path to either Save or Update the Database Notes: The default path is $('{0}\BluGenie' -f $env:ProgramFiles) Example: C:\Program Files\BluGenie Alias: ValidateSet: Required? false Position? named Default value $('{0}\BluGenie' -f $env:ProgramFiles) Accept pipeline input? false Accept wildcard characters? false ``` #### UpdateDB ``` -UpdateDB [] Description: Save return data to the Sqlite Database Notes: Alias: ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### ForceDBUpdate ``` -ForceDBUpdate [] Description: Force an update of the return data to the Sqlite Database Notes: By default only new items are saved. The primary key is ( FullName ) Alias: ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### NewDBTable ``` -NewDBTable [] Description: Delete and Recreate the Database Table Notes: Alias: ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### Walkthrough ``` -Walkthrough [] Description: Start the dynamic help menu system to help walk through the current command and all of the parameters Notes: Alias: Help ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### ReturnObject ``` -ReturnObject [] Description: Return information as an Object Notes: By default the data is returned as a Hash Table Alias: ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### OutUnEscapedJSON ``` -OutUnEscapedJSON [] Description: Remove UnEsacped Char from the JSON information. Notes: This will beautify json and clean up the formatting. Alias: ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### OutYaml ``` -OutYaml [] Description: Return detailed information in Yaml Format Notes: Only supported in Posh 3.0 and above Alias: ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### FormatView ``` -FormatView Description: Automatically format the Return Object Notes: Yaml is only supported in Posh 3.0 and above Alias: ValidateSet: 'Table','Custom','CustomModified','None','JSON','OutUnEscapedJSON','CSV', 'Yaml' Required? false Position? named Default value None Accept pipeline input? false Accept wildcard characters? false ``` #### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).