Automated YARA scanners in LimaCharlie will run on all files loaded in memory (e.g. exe, dll, etc), and on the memory itself.

Files on disk can be scanned using a sensor command. You can trigger a Manual Scan that's run on-demand by:

  • Clicking the Run YARA scan button on the sensor details page,

  • Clicking the Manual Scan button on the YARA Scanners section,

  • Using the console,

  • Within the Response section of a D&R rule,

  • Using the LimaCharlie API

Did this answer your question?