How to update YARA rules in an air-gapped/offline environment?

To update the YARA rule set in an air-gapped/offline Sandbox environment, please follow these steps:

• Search for the latest release in the fsYara GitHub repository: https://github.com/filescanio/fsYara/releases
• Click on that release, and download the master_file.yarc file from the release assets:

• Transfer the downloaded master_file.yarc to your offline environment (e.g. using a USB drive)
• Replace the current master file in /home/sandbox/sandbox/transform/yara/rules/master_file.yarc with the new master file, and ensure that the sandbox user owns the new file:

cd /PATH/TO/YOUR/USB-DRIVE

sudo cp -f master_file.yarc /home/sandbox/sandbox/transform/yara/rules/master_file.yarc

sudo chown sandbox:sandbox /home/sandbox/sandbox/transform/yara/rules/master_file.yarc

• Restart the transform component of the sandbox service, so the updated YARA rules are loaded into memory:

sudo service sandbox restart-transform