Run

With yara available in your PATH

nix run git+https://github.com/karpfediem/yara-sigs local/path/to/scan
nix run . local/path/to/scan

Without yara available in your PATH

nix develop git+https://github.com/karpfediem/yara-sigs -c yara-sigs local/path/to/scan
nix develop . -c yara-sigs local/path/to/scan

Components

Signatures

A collection of malware signatures: https://github.com/Neo23x0/signature-base

Some signatures are only compatible with proprietary signature checkers THOR or LOKI. Signatures incompatible with yara are filtered out.

Wrapper script

A tiny wrapper script around yara (https://github.com/VirusTotal/yara) - yara-sigs which calls yara with the directory of the filtered signatures above.