seanthegeek / yaramail

A Python package and command line utility for scanning emails with YARA rules

yaramail

yaramail is a Python package and command line utility for scanning emails with YARA rules. It is ideal for automated triage of phishing reports.

CLI Demo

Features

• Scans all parts of an email via API or CLI
  • Headers
    • Removes header indents by default for consistent scanning
  • Plain text and HTML body content
    • Converts body content to Markdown by default for consistent scanning
  • Attachments
    • Raw file content
    • Emails attached to emails
    • PDF document text
    • ZIP file contents, including nested ZIP files
      • Uses message body content as a list of possible ZIP passwords
      • Customizable list of passwords to use when attempting to scan encrypted ZIP files
• Provides a built-in methodology for categorizing emails
• Parses Authentication-Results headers

yaramail's Issues

TypeError: Object of type StringMatch is not JSON serializable

Changes in yara-python 4.3.0 cause the error "TypeError: Object of type StringMatch is not JSON serializable" to occour when the yaramail attempts CLI attempts te generate results in JSON format.

See: VirusTotal/yara-python#230

readthedocs docu needs an update

Hi,

read the docs [0] still gives the old/wrong install infos

pip3 install -U yaramail

cool project, thx

[0]
https://seanthegeek.github.io/yaramail/index.html#