Check if a file is an ELF executable using YARA rules.
(filepath)
| 811 | |
| 812 | |
| 813 | def is_elf_using_yara(filepath): |
| 814 | """Check if a file is an ELF executable using YARA rules.""" |
| 815 | rule = yara.compile(source=YARA_RULES) |
| 816 | matches = rule.match(filepath) |
| 817 | return any(match.rule == "ELF_Detection" for match in matches) |
| 818 | |
| 819 | |
| 820 | def is_suspicious_elf(filepath): |