seanthegeek / yaramail Public

Notifications You must be signed in to change notification settings
Fork 4
Star 20

A Python package and command line utility for scanning emails with YARA rules

seanthegeek.github.io/yaramail/

Apache-2.0 license

20 stars 4 forks Branches Tags Activity

Notifications

Name		Name	Last commit message	Last commit date
Latest commit History 234 Commits
.github/workflows		.github/workflows
.vscode		.vscode
docs		docs
test		test
yaramail		yaramail
.gitignore		.gitignore
CHANGELOG.md		CHANGELOG.md
LICENSE		LICENSE
README.md		README.md
build.sh		build.sh
demo.cast		demo.cast
publish-docs.sh		publish-docs.sh
pyproject.toml		pyproject.toml
requirements.txt		requirements.txt
setup.sh		setup.sh

Repository files navigation

yaramail

yaramail is a Python package and command line utility for scanning emails with YARA rules. It is ideal for automated triage of phishing reports.

CLI Demo

Features

Scans all parts of an email via API or CLI
- Headers
  - Removes header indents by default for consistent scanning
- Plain text and HTML body content
  - Converts body content to Markdown by default for consistent scanning
- Attachments
  - Raw file content
  - Emails attached to emails
  - PDF document text
  - ZIP file contents, including nested ZIP files
    - Uses message body content as a list of possible ZIP passwords
    - Customizable list of passwords to use when attempting to scan encrypted ZIP files
Provides a built-in methodology for categorizing emails
Parses Authentication-Results headers