Will yara scan rules on two different files with rule referencing condition?

[nagaraj2593]

Hi Folks ,need an help to understand the scanning logic

I have a string in a.txt and another string in b.txt ,i am writing a rule with rule referencing condition to match this

rule rule1
{
strings:
$a = "dummy"

condition
all of them
}

rule rule2
{
strings
$a = "dummy1"

condition
all of ($a*) and rule1
}

Expecting output results from rule2

[plusvic]

Yes, you can do that with yara a.txt b.txt file_to_scan. The last positional argument to yara is the file to be scanned, but the rest of them are source files. All those source files share a common namespace (unless you explicitly specify your own namespaces) and therefore rule1 will be visible from rule2.

This won't work: yara namespace1:a.txt namespace2:b.txt file_to_scan, because now a.txt and b.txt don't share the same namespace.