Hi Team,

I would like test sample yara rules on Linux via Offline Collector.

Exported the offline collector via Linux.Detection.Yara.Process and used that following sample yara rule.

I confirm that there is no hits under the results files.

could you please assist me to tackle this issue?

/uploads/scope/results# ls -rlt
total 0
-rw-r----- 1 root root 0 Dec 31 1979 Linux.Detection.Yara.Process.json.index
-rw-r----- 1 root root 0 Dec 31 1979 Linux.Detection.Yara.Process.json

:/tmp# cat malicious_file
malware_signature
http://malicious-site.com

/tmp# hexdump -C /tmp/malicious_file
00000000 6d 61 6c 77 61 72 65 5f 73 69 67 6e 61 74 75 72 |malware_signatur|
00000010 65 0a 68 74 74 70 3a 2f 2f 6d 61 6c 69 63 69 6f |e.http://malicio|
00000020 75 73 2d 73 69 74 65 2e 63 6f 6d 0a e8 90 90 90 |us-site.com.....|
00000030 90 5d c3 |.].|

rule testingyara {
    meta:
        description = "Detects a specific malicious file stored in /tmp"
        author = "User"
        date = "2025-02-13"
    
    strings:
        $malicious_string = "malware_signature" nocase
        $hex_pattern = { E8 ?? ?? ?? ?? 5D C3 }
        $url = "http://malicious-site.com"
    
    condition:
        any of ($malicious_string, $hex_pattern, $url) and 
        filepath matches "/tmp/malicious_file"
}