Sort a shared upload folder by rule tag
A customer upload share was abused. Scan it with a tagged rule set, print the tags, and count what kind of malicious content is there before deciding who to call first.
Briefing
A misconfigured upload share accepted any file for a month. Hosting wants to know what is in it before they wipe it.
YARA rules can carry tags after a colon. yara -g prints them next to each match, which makes a quick summary with cut, sort, and uniq -c.
detect-lab · YARA triage
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.