private string PopulateYaraInfo(List <YaraFilter> yaraFilters) { List <string> distinctRulesToRun = yaraFilters .SelectMany(yf => yf.ProcessRule(this)) .Distinct() .OrderBy(s => s) .ToList(); if (!distinctRulesToRun.Any()) { distinctRulesToRun = yaraFilters .Where(yf => yf.FilterType == YaraFilterType.ElseNoMatch) .SelectMany(yf => yf.OnMatchRules) .Distinct() .ToList(); } if (!distinctRulesToRun.Any()) { return(string.Empty); } _timingMetrics.Start(TimingMetric.YaraIndexBuilding); string yaraIndexContents = YaraHelper.MakeYaraIndexFile(distinctRulesToRun); string indexFileHash = Hash.ByteArray.Sha256(Encoding.UTF8.GetBytes(yaraIndexContents)); string yaraIndexFilename = Path.Combine(Path.GetTempPath(), $"{indexFileHash}-index.yar"); if (!File.Exists(yaraIndexFilename)) { File.WriteAllText(yaraIndexFilename, yaraIndexContents); } _timingMetrics.Stop(TimingMetric.YaraIndexBuilding); return(yaraIndexFilename); }