Check if an ELF file has potential malware traits using YARA rules.
(filepath)
| 818 | |
| 819 | |
| 820 | def is_suspicious_elf(filepath): |
| 821 | """Check if an ELF file has potential malware traits using YARA rules.""" |
| 822 | rule = yara.compile(source=YARA_RULES) |
| 823 | matches = rule.match(filepath) |
| 824 | return any(match.rule == "ELF_Malware" for match in matches) |
| 825 | |
| 826 | |
| 827 | def is_elf_using_magic(filepath): |