Guys,

clamscan --database=test.yar blah.html LibClamAV Error: yyerror(): test.yar line 6 undefined identifier "filename" LibClamAV Error: cli_loadyara: failed to parse rules file test.yar, error count 1
test.yar: OK
blah.html: OK

test.yar
rule TEST_BLAH_FILENAME
{
    strings:
        $BLAH = "blah"
         condition:
         $BLAH and filename == "blah.html"
}

Am I missing something? or is filename unsupported by ClamAV's YARA engine?

Thanks!
Axb
_______________________________________________
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Reply via email to