Invoke-BluGenieYara

﻿
Invoke-BluGenieYara
SYNOPSIS
Yara Scanner
SYNTAX
Invoke-BluGenieYara [[-ItemToScan] <String[]>] [-Rules <String>] [-RulesSource <String[]>] [-CompiledRules] [-ToolPath <String>] [-Count] [-Tag <String>] [-Identifier <String>] [-Negate] [-PrintTags] [-PrintMeta] 
[-MaxStringsPerRule <Int32>] [-PrintStrings] [-PrintStats] [-PrintNamespace] [-Threads <Int32>] [-PrintStringLength <Int32>] [-MaxRules <Int32>] [-Timeout <Int32>] [-Recurse] [-FastScan] [-StasckSize <Int32>] 
[-FailOnWarnings] [-NoWarnings] [-Version] [-CommandHelp] [-ClearGarbageCollecting] [-UseCache] [-CachePath <String>] [-RemoveCache] [-DBName <String>] [-DBPath <String>] [-UpdateDB] [-ForceDBUpdate] 
[-NewDBTable] [-Walkthrough] [-ReturnObject] [-OutUnEscapedJSON] [-OutYaml] [-FormatView <String>] [<CommonParameters>]
DESCRIPTION
Invoke-BluGenieYara is a wrapper around the YARA tool. The Yara tools is designed to help malware researchers identify and classify malware samples. It’s been called the pattern-matching Swiss Army knife for security researchers (and everyone else).
EXAMPLES
EXAMPLE 1
Command: Invoke-BluGenieYara -ItemToScan $env:TEMP
Description: Scan all files under $env:temp directory with any .Yar rules found
Notes:
EXAMPLE 2
Command: Invoke-BluGenieYara -ItemToScan $env:TEMP -Recurse
Description: Recursive Directory Scan
Notes:
EXAMPLE 3
Command: Invoke-BGYara -ItemToScan $env:TEMP -Recurse
Description: Use the (BG) Alias to run Yara
Notes:
EXAMPLE 4
Command: Yara -ItemToScan $env:TEMP -Recurse
Description: Use the Short Name Alias to run Yara scan
Notes:
EXAMPLE 5
Command: Invoke-BluGenieYara -ItemToScan "$env:TEMP\AttachmentArchive.msg" -Rules 'Attachment'
Description: Run all Rules with Attachment in the name against the .MSG file in the temp direcotry
Notes:
EXAMPLE 6
Command: Invoke-BluGenieYara -ItemToScan "$env:TEMP\AttachmentArchive.msg" -Rules 'Attachment' -RulesSource Z:\YaraRules\Email
Description: Run all Rules with Attachment in the name from a specific source, against the .MSG file in the temp direcotry
Notes:
EXAMPLE 7
Command: Invoke-BluGenieYara -ItemToScan $(Get-Process -Name notepad++ | Select-Object -ExpandProperty ID)
Description: Scan a PID
Notes:
EXAMPLE 8
Command: Invoke-BluGenieYara -ItemToScan 'AllPids'
Description: Scan all PID using all found .Yar rules
Notes:
EXAMPLE 9
Command: Invoke-BluGenieYara -ItemToScan $env:TEMP -UseCache
Description: Cache found objects to disk to not over tax Memory resources
Notes: By default the Cache location is %SystemDrive%\Windows\Temp
EXAMPLE 10
Command: Invoke-BluGenieYara -ItemToScan $env:TEMP -UseCache -RemoveCache
Description: Remove Cache data
Notes: By default the Cache information is removed right before the data is returned to the caller
EXAMPLE 11
Command: Invoke-BluGenieYara -ItemToScan $env:TEMP -UseCache -CachePath $Env:Temp
Description: Change the Cache path to the current users Temp directory
Notes: By default the Cache location is %SystemDrive%\Windows\Temp
EXAMPLE 12
Command: Invoke-BluGenieYara -ItemToScan $env:TEMP -UseCache -ClearGarbageCollecting
Description: Scan large directories and limit the memory used to track data
Notes:
EXAMPLE 13
Command: Invoke-BluGenieYara -Help
Description: Call Help Information
Notes: If Help / WalkThrough is setup as a parameter, this script will be called to setup the Dynamic Help Menu if not the normal
Get-Help will be called with the -Full parameter
EXAMPLE 14
Command: Invoke-BluGenieYara -WalkThrough
Description: Call Help Information [2]
Notes: If Help / WalkThrough is setup as a parameter, this script will be called to setup the Dynamic Help Menu if not the normal
Get-Help will be called with the -Full parameter
EXAMPLE 15
Command: Invoke-BluGenieYara -ItemToScan $env:TEMP -OutUnEscapedJSON
Description: Return a detailed function report in an UnEscaped JSON format
Notes:  The OutUnEscapedJSON is used to Beautify the JSON return and not Escape any Characters.  Normal return data is a Hash Table.
EXAMPLE 16
Command: Invoke-BluGenieYara -ItemToScan $env:TEMP -OutYaml
Description: Return a detailed function report in YAML format
Notes:  The OutUnEscapedJSON is used to Beautify the JSON return and not Escape any Characters.  Normal return data is a Hash Table.
EXAMPLE 17
Command: Invoke-BluGenieYara -ItemToScan $env:TEMP -ReturnObject
Description: Return Output as a Object
Notes:  The ReturnObject is used to return a PowerShell Object.  Normal return data is a Hash Table.
       This parameter is also used with the FormatView
EXAMPLE 18
Command: Invoke-BluGenieYara -ItemToScan $env:TEMP -ReturnObject -FormatView Yaml
Description: Output PSObject information in Yaml format
Notes:  Current formats supported by default are ('Table','Custom','CustomModified','None','JSON','OutUnEscapedJSON','CSV', 'Yaml')
       Default is set to (None) and normal PSObject.
PARAMETERS
ItemToScan
-ItemToScan <String[]>
   Description: File(s), Directory, PID, or AllPids Scan
   Notes:  If ItemToScan = "AllPids", every PID on the System will be scanned
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    1
   Default value                
   Accept pipeline input?       false
   Accept wildcard characters?  false
Rules
-Rules <String>
   Description: .Yar Rule Names (Filtered with RegEx)
   Notes:  Default is set to '.*'
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                .*
   Accept pipeline input?       false
   Accept wildcard characters?  false
RulesSource
-RulesSource <String[]>
   Description: Source path to for your .Yar Rule files
   Notes:  Default Search Paths
   			* $Env:SystemDrive\Windows\Temp
   			* %Current Script Directory%
   			* $Env:Temp
   			This scan is not recursive.
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                
   Accept pipeline input?       false
   Accept wildcard characters?  false
CompiledRules
-CompiledRules [<SwitchParameter>]
   Description: Load compiled rules
   Notes:
   Alias: 'CR'
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
ToolPath
-ToolPath <String>
   Description:
   Notes: Default is set to  $('{0}\Windows\Temp' -f $env:SystemDrive)
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                $(Join-Path -Path $ToolsDirectory -ChildPath 'Yara')
   Accept pipeline input?       false
   Accept wildcard characters?  false
Count
-Count [<SwitchParameter>]
   Description: Print only number of matches
   Notes:
   Alias: 'C'
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
Tag
-Tag <String>
   Description: Print only rules tagged as TAG
   Notes: tag=TAG
   Alias: 'T'
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                
   Accept pipeline input?       false
   Accept wildcard characters?  false
Identifier
-Identifier <String>
   Description: Print only rules named IDENTIFIER
   Notes: identifier=IDENTIFIER
   Alias: 'I'
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                
   Accept pipeline input?       false
   Accept wildcard characters?  false
Negate
-Negate [<SwitchParameter>]
   Description: Print only not satisfied rules (negate)
   Notes:
   Alias: 'N'
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
PrintTags
-PrintTags [<SwitchParameter>]
   Description: Print tags
   Notes:
   Alias: 'PT'
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
PrintMeta
-PrintMeta [<SwitchParameter>]
   Description: Print metadata
   Notes:
   Alias: 'PM'
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
MaxStringsPerRule
-MaxStringsPerRule <Int32>
   Description: Set maximum number of strings per rule (default=10000)
   Notes:
   Alias: 'MS'
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                0
   Accept pipeline input?       false
   Accept wildcard characters?  false
PrintStrings
-PrintStrings [<SwitchParameter>]
   Description: Print matching strings
   Notes:
   Alias: 'PS'
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
PrintStats
-PrintStats [<SwitchParameter>]
   Description: Print rules' statistics
   Notes:
   Alias: 'PA'
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
PrintNamespace
-PrintNamespace [<SwitchParameter>]
   Description: Print rules' namespace
   Notes:
   Alias: 'PN'
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
Threads
-Threads <Int32>
   Description: Use the specified NUMBER of threads to scan a directory
   Notes:
   Alias: 'TR'
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                0
   Accept pipeline input?       false
   Accept wildcard characters?  false
PrintStringLength
-PrintStringLength <Int32>
   Description: Print length of matched strings
   Notes:
   Alias: 'PL'
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                0
   Accept pipeline input?       false
   Accept wildcard characters?  false
MaxRules
-MaxRules <Int32>
   Description: Abort scanning after matching a NUMBER of rules
   Notes:
   Alias: 'M'
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                0
   Accept pipeline input?       false
   Accept wildcard characters?  false
Timeout
-Timeout <Int32>
   Description: Abort scanning after the given number of SECONDS
   Notes:
   Alias: 'TO'
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                0
   Accept pipeline input?       false
   Accept wildcard characters?  false
Recurse
-Recurse [<SwitchParameter>]
   Description: Recursively search directories (follows symlinks)
   Notes:
   Alias: 'R'
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
FastScan
-FastScan [<SwitchParameter>]
   Description: Fast matching mode
   Notes:
   Alias: 'F'
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
StasckSize
-StasckSize <Int32>
   Description: Set maximum stack size (default=16384)
   Notes:
   Alias: 'SS'
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                0
   Accept pipeline input?       false
   Accept wildcard characters?  false
FailOnWarnings
-FailOnWarnings [<SwitchParameter>]
   Description: Fail on warnings
   Notes:
   Alias: 'FW'
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
NoWarnings
-NoWarnings [<SwitchParameter>]
   Description: Disable warnings
   Notes:
   Alias: 'NW'
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
Version
-Version [<SwitchParameter>]
   Description: Show version information
   Notes:
   Alias: 'V'
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
CommandHelp
-CommandHelp [<SwitchParameter>]
   Description: Show the Yara command help
   Notes:
   Alias: 'CH'
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
ClearGarbageCollecting
-ClearGarbageCollecting [<SwitchParameter>]
   Description: Garbage Collection in Powershell to Speed up Scripts and help lower memory consumption
   Notes: This is enabled by default.  To disable use -ClearGarbageCollecting:$False
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
UseCache
-UseCache [<SwitchParameter>]
   Description: Cache found objects to disk.  This is to not over tax Memory resources with found artifacts
   Notes: By default the Cache location is %SystemDrive%\Windows\Temp
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
CachePath
-CachePath <String>
   Description: Path to store the Cache information
   Notes: By default the Cache location is %SystemDrive%\Windows\Temp
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                $('{0}\Windows\Temp\{1}.log' -f $env:SystemDrive, $(New-BluGenieUID))
   Accept pipeline input?       false
   Accept wildcard characters?  false
RemoveCache
-RemoveCache [<SwitchParameter>]
   Description: Remove Cache data on completion
   Notes: Cache information is removed right before the data is returned to the calling process
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
DBName
-DBName <String>
   Description: Database Name (Without extention)
   Notes: The default name is set to 'BluGenie'
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                BluGenie
   Accept pipeline input?       false
   Accept wildcard characters?  false
DBPath
-DBPath <String>
   Description: Path to either Save or Update the Database
   Notes: The default path is $('{0}\BluGenie' -f $env:ProgramFiles)  Example: C:\Program Files\BluGenie
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                $('{0}\BluGenie' -f $env:ProgramFiles)
   Accept pipeline input?       false
   Accept wildcard characters?  false
UpdateDB
-UpdateDB [<SwitchParameter>]
   Description: Save return data to the Sqlite Database
   Notes:
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
ForceDBUpdate
-ForceDBUpdate [<SwitchParameter>]
   Description: Force an update of the return data to the Sqlite Database
   Notes: By default only new items are saved.  The primary key is ( FullName )
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
NewDBTable
-NewDBTable [<SwitchParameter>]
   Description: Delete and Recreate the Database Table
   Notes:
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
Walkthrough
-Walkthrough [<SwitchParameter>]
   Description:  Start the dynamic help menu system to help walk through the current command and all of the parameters
   Notes:
   Alias: Help
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
ReturnObject
-ReturnObject [<SwitchParameter>]
   Description: Return information as an Object
   Notes: By default the data is returned as a Hash Table
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
OutUnEscapedJSON
-OutUnEscapedJSON [<SwitchParameter>]
   Description: Remove UnEsacped Char from the JSON information.
   Notes: This will beautify json and clean up the formatting.
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
OutYaml
-OutYaml [<SwitchParameter>]
   Description: Return detailed information in Yaml Format
   Notes: Only supported in Posh 3.0 and above
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
FormatView
-FormatView <String>
   Description: Automatically format the Return Object
   Notes: Yaml is only supported in Posh 3.0 and above
   Alias:
   ValidateSet: 'Table','Custom','CustomModified','None','JSON','OutUnEscapedJSON','CSV', 'Yaml'
   
   Required?                    false
   Position?                    named
   Default value                None
   Accept pipeline input?       false
   Accept wildcard characters?  false
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.
Invoke-BluGenieWipe
Invoke-PSipcalc
Last modified 1yr ago