chore(yara, config): Restructure config file for Yara settings

rabbitstack · rabbitstack · commit 59662d9e36fe · 2024-11-02T21:10:23.000+01:00
diff --git a/configs/fibratus.yml b/configs/fibratus.yml
@@ -581,7 +581,8 @@ yara:
 
   # Contains rule paths and rule definition information
   rule:
-    # Represents the paths within the file system along with the YARA namespace identifier
+    # Represents the paths within the file system along with the YARA namespace identifier. All directories
+    # inside the path are traversed recursively for YARA rule files.
     paths:
       - path: ""
         namespace: ""
@@ -591,27 +592,32 @@ yara:
       - string:
         namespace:
 
-  # Indicates which sender is used to transport the alert generated by scanner
-  #alert-via: mail
-
-  # Specifies templates for the alert title and text in Go templating language (https://golang.org/pkg/text/template)
+  # Specifies templates for the alert text in Go templating language (https://golang.org/pkg/text/template)
   #alert-template:
-  #  title:
-  #  text:
 
   # Determines when multiple matches of the same string can be avoided when not necessary
   #fastscan: true
 
   # Specifies the timeout for the scanner. If the timeout is reached, the scan operation is cancelled
   #scan-timeout: 20s
 
-  # Indicates whether file scanning is disabled. This affects the scan triggered by the image loading events.
-  #skip-files: true
+  # Indicates whether file scanning is disabled. This affects the scan triggered by the image loading, create
+  # file, and file mapping operations.
+  #skip-files: false
+
+  # Indicates whether scanning on suspicious memory allocations is disabled
+  #skip-allocs: false
+
+  # Indicates whether scanning on suspicious mappings of sections is disabled
+  #skip-mmaps: false
+
+  # Indicates whether registry value scanning is disabled
+  #skip-registry: false
 
-  # Contains the list of file names that shouldn't be scanned
+  # Contains the list of the comma-separated file paths that shouldn't be scanned. Wildcard matching is possible
   #excluded-files:
-  #  - kernel32.dll
+  #  - ?:\\Windows\\System32\\kernel32.dll
 
-  # Contains the list of the process' image names that shouldn't be scanned
+  # Contains the list of the comma-separated process image paths that shouldn't be scanned. Wildcard matching is possible.
   #excluded-procs:
   #  - System
