nordisk/holger

scripts/demo/yara/eicar.yar

// The demo's YARA rule set: the EICAR anti-malware test file.
//
// EICAR is the industry's harmless test string: every engine detects it, and it
// does nothing. The demo plants it in a wheel and proves that Holger refuses that
// wheel by this rule's name. The rule stays inside the subset Holger's built-in
// matcher runs (server/inspect/src/yara_lite.rs), so no yara binary is needed on
// either side of the airgap. Add a site's own rules beside it as more .yar files.
rule EICAR_Test_File : test
{
    meta:
        description = "The EICAR anti-malware test file"
        reference = "https://www.eicar.org/download-anti-malware-testfile/"
    strings:
        $eicar = "EICAR-STANDARD-ANTIVIRUS-TEST-FILE"
    condition:
        $eicar
}