volatility-misp is a volatility plugin that allows to pull yara rules from a MISP instance's yara attributes and use them in yarascan.
This is a work in progress, no documentation available yet
- Python 2.7 if used as a volatility module
- Python 2.7 or 3+ if used as a library (excluding volatility_misp.py)
- PyMISP
- yara-python
- volatility
- Pulling yara rules from a MISP server
- Sorting valid yara rules from broken rules
- Suggesting fixes for some of the broken rules (currently unused)
- Running the valid yara rules on a memory dump (same capabilities and options as yarascan)