Missing installation step in Yara and testing step improvement

[javimed]

• Missing step for Yara installation in Detecting malware on Linux endpoints using YARA use case in Malware capabilities documentation

  Following the steps might lead to a wrong installation

  vagrant@ag-ubuntu20:/usr/local/bin/yara-4.2.3$ yara
  yara: error while loading shared libraries: libyara.so.9: cannot open shared object file: No such file or directory
  

  A step should be added in the same it's already present in Detecting malware using Yara integration PoC

  

  vagrant@ag-ubuntu20:/usr/local/bin/yara-4.2.3$ sudo su
  root@ag-ubuntu20:/usr/local/bin/yara-4.2.3# echo "/usr/local/lib" >> /etc/ld.so.conf
  root@ag-ubuntu20:/usr/local/bin/yara-4.2.3# ldconfig
  root@ag-ubuntu20:/usr/local/bin/yara-4.2.3# exit
  exit
  vagrant@ag-ubuntu20:/usr/local/bin/yara-4.2.3$ yara
  yara: wrong number of arguments
  Usage: yara [OPTION]... [NAMESPACE:]RULES_FILE... FILE | DIR | PID
  
  Try `--help` for more options
  vagrant@ag-ubuntu20:/usr/local/bin/yara-4.2.3$
  

• Downloading samples directly to the monitored directory triggers alerts repetitions

  vagrant@ag-ubuntu20:/usr/local/bin/yara-4.2.3$ sudo curl https://wazuh-demo.s3-us-west-1.amazonaws.com/mirai --output /root/mirai
    % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                   Dload  Upload   Total   Spent    Left  Speed
  100 79804  100 79804    0     0  26557      0  0:00:03  0:00:03 --:--:-- 26557
  vagrant@ag-ubuntu20:/usr/local/bin/yara-4.2.3$ sudo curl https://wazuh-demo.s3-us-west-1.amazonaws.com/xbash --output /root/Xbash
    % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                   Dload  Upload   Total   Spent    Left  Speed
  100 9344k  100 9344k    0     0   507k      0  0:00:18  0:00:18 --:--:-- 1352k
  vagrant@ag-ubuntu20:/usr/local/bin/yara-4.2.3$ 
  

  

  vagrant@ag-ubuntu20:/usr/local/bin/yara-4.2.3$ curl https://wazuh-demo.s3-us-west-1.amazonaws.com/mirai --output ~/mirai
    % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                   Dload  Upload   Total   Spent    Left  Speed
  100 79804  100 79804    0     0  43561      0  0:00:01  0:00:01 --:--:-- 43537
  vagrant@ag-ubuntu20:/usr/local/bin/yara-4.2.3$ curl https://wazuh-demo.s3-us-west-1.amazonaws.com/xbash --output ~/Xbash
    % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                   Dload  Upload   Total   Spent    Left  Speed
  100 9344k  100 9344k    0     0  1095k      0  0:00:08  0:00:08 --:--:-- 1486k
  vagrant@ag-ubuntu20:/usr/local/bin/yara-4.2.3$ sudo mv ~/mirai /root/
  vagrant@ag-ubuntu20:/usr/local/bin/yara-4.2.3$ sudo mv ~/Xbash /root/
  vagrant@ag-ubuntu20:/usr/local/bin/yara-4.2.3$ 
  

  

[TheMuntu]

Fixed!