There's no clever way for doing that. Even detecting two identical rules that have different names is complicated. If manually curating the sets of rules is not an option I would simply use the union.
On Mon, May 30, 2016 at 10:33 PM, <[email protected]> wrote: > Hi, > > I am looking for a clever way of unifying Yara rules. > Suppose you have 2 sets of Yara rules, and suppose you know that they are > targeting the same threat (for example, catch some shared files). > > What do you think is a clever way of unifying these rules, except of the > obvious of simple union? > > -- > You received this message because you are subscribed to the Google Groups > "YARA" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > -- You received this message because you are subscribed to the Google Groups "YARA" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
