YARA Scanner

Investigate suspicious files in the file store

YARA Scanner checks file contents against YARA detection rules. Use it to investigate files collected from EDR alerts or to validate detection rules against malware samples obtained from Google Threat Intelligence and SANDS Lab's CTX.io. The scanner examines files without executing them.

The workflow is acquire files → save them in the file store → scan with YARA → inspect matching rules → investigate and improve detection.

1. Prepare for scanning

Install the File Store and YARA Scanner apps, and sign in with an account that can read the target files. In YARA Rules, enable the built-in and user-defined rules you want to use. After adding or editing rules, wait for the changes to finish applying before scanning.

Organize files by case and record their original names, SHA-256 hashes, source, collection time, and related alert IDs. Start each file store path with the app name, then place investigation folders and files beneath it. For example:

Replace HASH with the file hash and CASE_GUID with the folder identifier grouping your investigation files. Replace ctx, SHA256, and SCAN_GUID with your connection profile name, file hash, and scan ID. Replace file paths with the actual locations of your stored files.

2. Acquire files from each source

Download and immediately scan a CTX.io sample

Install a CTX app version that provides ctx-download-file and configure a connection profile with sample download access. The hash option accepts MD5, SHA-1, or SHA-256.

This query downloads a sample, retains it in the file store for seven days, and scans it immediately:

ctx-download-file profile=ctx hash="SHA256" expiry=7d
| yara-scan-batch
| fields hash, file_url, _matched_count, _matched_rules, _error

ctx-download-file returns file_url, which yara-scan-batch reads by default. No URL field conversion is needed. When path is omitted, the file is saved to sonar://sandslab-ctx/HASH.bin, where HASH is the requested hash converted to uppercase. file_url returns this destination URL. Downloading the same hash again overwrites the existing file. Omitting expiry retains the file without an expiration date.

To set the destination explicitly, specify path including the file name as follows. Replace HASH with the hash of the file to download:

ctx-download-file profile=ctx hash="SHA256" path="sonar://sandslab-ctx/HASH.bin" expiry=7d
| yara-scan-batch
| fields hash, file_url, _matched_count, _matched_rules, _error

Use distinct or hash-based names when collecting multiple files. The expiry option in this example applies to sonar:// destinations. If the download itself fails, resolve the CTX error first. File scanning errors after download appear in _error.

Threat files collected by Genian EDR

Follow these steps to acquire threat files from Genian EDR. Genian EDR administrator guide — File Collection

1. In Genian EDR, open Analysis > Threats > Management, select the threat's Details, and identify the file hash, original path, and endpoint.
2. Request Collect Sample, then retrieve the collected file through Download Samples or Analysis > Investigation > Acquisitions.
3. Open File Store → File Explorer and upload the file to genian-edr/CASE_GUID.
4. Copy the file URL, such as sonar://genian-edr/CASE_GUID/suspect.bin, from its details panel and use it for scanning.

An EDR quarantine file or export bundle may differ from the original file. To test detection of the original, use the product's supported method to recover its original bytes. If you want to inspect individual files inside an archive, extract them in your analysis environment and upload them separately. YARA Scanner does not automatically extract archive contents.

Samples downloaded from Google Threat Intelligence

Look up the file hash in Google Threat Intelligence and use Download sample in the file report to retrieve a sample you have permission to access. Automated collection can use the official file download API. File report documentation, file download API

Upload the acquired file to the google-ti folder as HASH.bin through File Explorer and obtain its URL, such as sonar://google-ti/HASH.bin. Replace HASH with the file hash. Compare its hash with the report, then use the report's malware classification and behavior information alongside the YARA findings. Scan the URL of the stored file, rather than an external report URL or download link.

3. Scan stored files with queries

To inspect a single file, pass its file store URL to yara-scan:

yara-scan url="sonar://genian-edr/CASE_GUID/suspect.bin"

You can also scan the entire investigation folder containing the Genian EDR files. Subfolders are included by default.

yara-scan url="sonar://genian-edr/CASE_GUID" recursive=t

yara-scan returns one row per file. matched_count is the number of matches, matched_rules contains matching rule names, and error contains a scanning error. Successful scans return matched_count and matched_rules; failed scans return error. Review errors before classifying unmatched files as clean.

yara-scan-batch reads file_url from each input row. In the CTX examples above, hash and file_url are outputs of ctx-download-file. The fields added by the YARA batch scan are _matched_count, _matched_rules, and _error.

Successful scans add _matched_count and _matched_rules; failures add an error in _error. Existing input fields are preserved. Before rescanning rows that contain previous results, remove their existing _matched_count, _matched_rules, and _error fields to avoid confusing old values with the new scan.

Both scanning commands default to 60 seconds per file and a maximum file size of 64 MiB. If larger files must be inspected, review their size and available processing capacity before adjusting the options:

yara-scan url="sonar://genian-edr/CASE_GUID/suspect.bin" timeout=120 max-size=134217728

max-size is measured in bytes; this example permits files up to 128 MiB. Query scans return results to the query and do not automatically create scan history or reports. Use the screen workflow below when you need recorded scan history.

4. Scan from the screen and review reports

1. Open YARA Scan.
2. Enter a file or folder's sonar:// URL in Target Path, or select a folder with Browse.
3. For a folder, choose whether to Include subfolders, then select Start Scan.
4. Monitor scanned files, detections, and errors. Select Run in background to continue working while the scan runs.
5. Open a completed entry in Scan History to view its Scan Report. Review detected files, top matching rules, scan time, and errors.
6. Select a rule name to inspect its contents in the panel on the right. Escape closes the rule panel while keeping the report open.

Scans started from the screen can also be queried:

yara-scan-reports duration=7d

To inspect file results for a particular scan, use its report's guid value as the scan_guid filter:

yara-scan-logs duration=7d
| search scan_guid == "SCAN_GUID"

Per-file scan logs record detections and errors only. Files with neither are represented in the report totals. Choose a time range covering the scan from start to finish. If no time options are specified, the last 24 hours are queried.

5. Interpret and use the findings

The match count is not a severity score. Multiple rules can identify the same characteristic, and a match alone does not establish that a file is malicious or that a compromise occurred. No match does not establish that a file is safe.

For EDR-collected files, examine the host, user, parent process, execution time, and network connections to prioritize the investigation. Record matching rules and file hashes in the case, then compare confirmed indicators with logs from other endpoints to extend the investigation.

Use samples from Google Threat Intelligence or CTX.io to assess coverage of built-in and user-defined rules. Keep known malicious samples and benign files in separate collections, and rescan them before and after rule changes to compare detection coverage and false positives. If results differ from expectations, first verify the original hash, enabled rules, and whether rule changes have finished applying.

For reproducibility, retain the file URL, SHA-256, source report, scan time, matching rules, and a copy of the rules used. Perform response actions such as isolation or blocking through the appropriate response tool, such as your EDR, based on the investigation.

6. Troubleshooting

See the extension command documentation for full option and output field definitions.