example-spyre.yaml

## Global options

# ruleset-marker: investigation-1337

# default: spyre_$hostname_$datetime.log
report: spyre.log
evidence-collector:
  # disabled: true
  # default: spyre_$hostname_$datetime.zip
  file: spyre.zip
  password: infected
  max-size: 1G
# hostname: some-random-host
# max-file-size: 32M
# proc-ignore-names: ["chrome.exe"]
# paths: ["D:\\"]
# high-priority: true

ui:
  # So we can just launch spyre by double-click in a GUI without
  # having to worry about the console windows disappearing
  prompt-on-exit: true

## System scan module options
system:
  registry:
    # disabled: true
    config:
      iocs:
        "Winnti registry trace":
          key: "HKLM\\SOFTWARE\\Microsoft\\HTMLHelp\\data"

  eventobj:
    # disabled: true
    config:
      iocs:
        "Winnti event object":
          "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411016}"

  winkernelobj:
    # disabled: true
    config:
      iocs:
        "Mutex-based WINE environment detection":
          type: Mutant
          string: __WINE_FONT_MUTEX__

  findwindow:
    config:
      iocs:
        "APT.Turla.Chinch Window Class":
          class: "zQWwe2esf34356d"
          # name: <empty>

## File scan module options
file:
  yara:
    # disabled: true
    config:
      # fail-on-warnings: false
      rule-files:
        - files.yar

## Process memory scan module options
proc:
  yara:
    # disabled: true
    config:
      # fail-on-warnings: false
      rule-files:
        - procs.yar