CobaltStrike YARA规则 检测 环境搭建

import os
## https://github.com/chronicle/GCTI 项目下载后的目录
path = R"C:\Users\xxx\Desktop\test\GCTI\YARA\CobaltStrike"
def scan(path):
   file_list = os.listdir(path)
   for file in file_list:
       fullPath = os.path.join(path,file)
        ## yara.exe 路径
        ## 19684 为木马的pid，需要自己去替换
       cmd = R"D:\yara-4.2.3-2029-win64\yara64.exe " + fullPath + " 19684"
       result = os.popen(cmd).read()
       if result:
           print(result)
if __name__ == '__main__':
   scan(path)