[clamav-users] YARA: filesize condition

Axb axb.lists at gmail.com
Thu Jun 30 14:06:07 UTC 2016


When trying to use filesize conidtion in a Yara sig

rule FileSize_200KB
{
     condition:
        filesize < 200KB
}

I get

LibClamAV Warning: load_oneyara: yara rule contains no supported 
strings, skipping YARA.FileSizeExample

Am I missing something or if indeed not supported, could it please be 
added? Would help to "failsafe" rules

Thanks

Axb



More information about the clamav-users mailing list