yaraPcap
A Python tool that extracts HTTP streams from PCAP files and scans them with YARA rules for security analysis.
What is yaraPcap?
YaraPCAP is a Python-based security tool that processes PCAP (packet capture) files to extract HTTP streams and scan them with YARA rules. It helps security analysts identify malicious patterns in network traffic by applying signature-based detection to captured data. The tool automatically handles compressed content and generates reports of matches for further investigation.
Security researchers, network analysts, and incident responders who need to analyze captured network traffic for malicious activity using YARA rules.
Developers choose YaraPCAP for its focused approach to applying YARA pattern matching directly to network traffic, its automatic handling of compressed HTTP streams, and its simple command-line interface that integrates with existing forensic workflows.
Overview
Process HTTP Pcaps With YARA
Use Cases
Best For
- Analyzing PCAP files for malware indicators in HTTP traffic
- Applying YARA rules to network packet captures
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
