Automated YARA scanners in LimaCharlie will run on all files loaded in memory (e.g. exe, dll, etc), and on the memory itself.
Files on disk can be scanned using a sensor command. You can trigger a Manual Scan that's run on-demand by:
Clicking the
Run YARA scanbutton on the sensor details page,Clicking the
Manual Scanbutton on the YARA Scanners section,Using the console,
Within the Response section of a D&R rule,
Using the LimaCharlie API