workbench/yara-templates.ts

Provides a collection of YARA rule templates for malware, web shell, and credential dumping detection.

// Source: https://github.com/backbay-labs/clawdstrike | License: Apache-2.0 | Copyright You must retain, in the Source form of any Derivative Works
// Provided via justclaw.it.com; keep this notice with the code.
/**
 * Built-in YARA rule templates for the detection engineering IDE.
 */

export interface YaraTemplate {
  id: string;
  name: string;
  description: string;
  category: string;
  content: string;
}

export const YARA_TEMPLATES: YaraTemplate[] = [
  {
    id: "generic-malware",
    name: "Generic Malware Detection",
    description: "Detects PE files with suspicious import combinations commonly used by malware.",
    category: "Malware",
    content: `import "pe"

rule generic_malware_suspicious_imports {
    meta:
        author = "ClawdStrike"
        description = "Detects 

... (truncated -- full source via MCP)