I have a rule that starts with: rule Accept: This function is used to listen for incoming connections. This function indicates that the program will listen for incoming connections on a socket. It is mostly used by malware to communicate with their Command and Communication server. { strings: $a = "Accept" condition: any of them }
please refer to the line that starts with rule can I use the line above or do I have to do rule Accept /* This function is used to listen for incoming connections. This function indicates that the program will listen for incoming connections on a socket. It is mostly used by malware to communicate with their Command and Communication server. */ { strings: $a = "Accept" condition: any of them } I was hoping I could get yara to report out the entire line with explanation when hit hit a match. -- You received this message because you are subscribed to the Google Groups "YARA" group. To unsubscribe from this group and stop receiving emails from it, send an email to yara-project+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.