Troubleshooting Invalid YARA Rules

  1. On the Endpoint Sensor server, open a command prompt (cmd.exe) and navigate to the <Trend Micro Endpoint Sensor server installation path>\CmdTool\YARA folder.
  2. Issue the following command:
    $...\CmdTool\YARA>yara –m <YARA_file>

    <YARA_file> corresponds to full file name of the YARA file in question.

Note:

For additional command line options, refer to the YARA documentation online:

http://yara.readthedocs.org/en/latest/commandline.html

The following output appears:

$:\...\CmdTool\YARA>yara –m c:\invalid.yara
c:\invalid.yara(6): error: untermindated string
c:\invalid.yara(6): error: syntax error, unexpected $end, 
   expecting _REGEXP_

The error: ... results indicate that the YARA file in question does not adhere to the syntax required to validate and parse YARA files. To solve the issue, follow the instructions available from http://plusvic.github.io/yara/.