Am 23.02.2016 um 19:58 schrieb Per-Erik Persson:
I have just played around with yara but you need to be careful and read/understand each rule before dropping it into the clamav DB directory. There are rules that mark each mail without image and another marks each mail with an image. Clamav will detect this as infection and so will declare every single mail as infected.....Has anyone tried a recent clamav with YARA support and yara-rules available?
JC
