godaddy/procfilter

Question: Logging Matched String From Yara Rule Matched

dfirence opened this issue · 1 comments

Greetings and Thank You For This AWESOME Tool!

Is it possible to obtain from the Windows Event Log Entry:

  1. the actual string that matched from the Yara Rule that is written?

In the screenshot below, I successfully am matching, but I would like to know how can the matched string be provided in the details.

Writing the Test Yara Rule

image


Successfully Matching in Windows Log

image

Any update, please?