dissect.target 3.19.dev21__tar.gz → 3.19.dev23__tar.gz

{dissect_target-3.19.dev21/dissect.target.egg-info → dissect_target-3.19.dev23}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.19.dev21
+Version: 3.19.dev23
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.19.dev21 → dissect_target-3.19.dev23}/dissect/target/helpers/network_managers.py

@@ -7,12 +7,14 @@ from configparser import ConfigParser, MissingSectionHeaderError
 from io import StringIO
 from itertools import chain
 from re import compile, sub
-from typing import Any, Callable, Iterable, Match, Optional
+from typing import Any, Callable, Iterable, Iterator, Match, Optional
 
 from defusedxml import ElementTree
 
 from dissect.target.exceptions import PluginError
 from dissect.target.helpers.fsutil import TargetPath
+from dissect.target.plugins.os.unix.log.journal import JournalRecord
+from dissect.target.plugins.os.unix.log.messages import MessagesRecord
 from dissect.target.target import Target
 
 log = logging.getLogger(__name__)
@@ -509,14 +511,15 @@ class LinuxNetworkManager:
         return values
 
 
-def parse_unix_dhcp_log_messages(target) -> list[str]:
+def parse_unix_dhcp_log_messages(target: Target, iter_all: bool = False) -> set[str]:
     """Parse local syslog, journal and cloud init-log files for DHCP lease IPs.
 
     Args:
         target: Target to discover and obtain network information from.
+        iter_all: Parse limited amount of journal messages (first 10000) or all of them.
 
     Returns:
-        List of DHCP ip addresses.
+        A set of found DHCP IP addresses.
     """
     ips = set()
     messages = set()
@@ -530,9 +533,19 @@ def parse_unix_dhcp_log_messages(target) -> list[str]:
     if not messages:
         target.log.warning(f"Could not search for DHCP leases using {log_func}: No log entries found.")
 
-    for record in messages:
+    def records_enumerate(iterable: Iterable) -> Iterator[tuple[int, JournalRecord | MessagesRecord]]:
+        count = 0
+        for rec in iterable:
+            if rec._desc.name == "linux/log/journal":
+                count += 1
+            yield count, rec
+
+    for count, record in records_enumerate(messages):
         line = record.message
 
+        if not line:
+            continue
+
         # Ubuntu cloud-init
         if "Received dhcp lease on" in line:
             interface, ip, netmask = re.search(r"Received dhcp lease on (\w{0,}) for (\S+)\/(\S+)", line).groups()
@@ -576,9 +589,11 @@ def parse_unix_dhcp_log_messages(target) -> list[str]:
             ips.add(ip)
             continue
 
-        # Journals and syslogs can be large and slow to iterate,
-        # so we stop if we have some results and have reached the journal plugin.
-        if len(ips) >= 2 and record._desc.name == "linux/log/journal":
+        # The journal parser is relatively slow, so we stop when we have read 10000 journal entries,
+        # or if we have found at least one ip address. When `iter_all` is `True` we continue searching.
+        if not iter_all and (ips or count > 10_000):
+            if not ips:
+                target.log.warning("No DHCP IP addresses found in first 10000 journal entries.")
             break
 
     return ips

dissect_target-3.19.dev23/dissect/target/plugins/filesystem/yara.py

@@ -0,0 +1,186 @@
+from __future__ import annotations
+
+import hashlib
+import logging
+from io import BytesIO
+from pathlib import Path
+from typing import Iterator
+
+from dissect.target.helpers import hashutil
+
+try:
+    import yara
+
+    HAS_YARA = True
+
+except ImportError:
+    HAS_YARA = False
+
+from dissect.target.exceptions import FileNotFoundError, UnsupportedPluginError
+from dissect.target.helpers.record import TargetRecordDescriptor
+from dissect.target.plugin import Plugin, arg, export
+
+log = logging.getLogger(__name__)
+
+YaraMatchRecord = TargetRecordDescriptor(
+    "filesystem/yara/match",
+    [
+        ("path", "path"),
+        ("digest", "digest"),
+        ("string", "rule"),
+        ("string[]", "tags"),
+        ("string", "namespace"),
+    ],
+)
+
+DEFAULT_MAX_SCAN_SIZE = 10 * 1024 * 1024
+
+
+class YaraPlugin(Plugin):
+    """Plugin to scan files against a local YARA rules file."""
+
+    def check_compatible(self) -> None:
+        if not HAS_YARA:
+            raise UnsupportedPluginError("Please install 'yara-python' to use the yara plugin.")
+
+    @arg("-r", "--rules", required=True, nargs="*", help="path(s) to YARA rule file(s) or folder(s)")
+    @arg("-p", "--path", default="/", help="path on target(s) to recursively scan")
+    @arg("-m", "--max-size", default=DEFAULT_MAX_SCAN_SIZE, help="maximum file size in bytes to scan")
+    @arg("-c", "--check", default=False, action="store_true", help="check if every YARA rule is valid")
+    @export(record=YaraMatchRecord)
+    def yara(
+        self,
+        rules: list[str | Path],
+        path: str = "/",
+        max_size: int = DEFAULT_MAX_SCAN_SIZE,
+        check: bool = False,
+    ) -> Iterator[YaraMatchRecord]:
+        """Scan files inside the target up to a given maximum size with YARA rule file(s).
+
+        Args:
+            rules: ``list`` of strings or ``Path`` objects pointing to rule files to use.
+            path: ``string`` of absolute target path to scan.
+            max_size: Files larger than this size will not be scanned.
+            check: Check if provided rules are valid, only compiles valid rules.
+
+        Returns:
+            Iterator yields ``YaraMatchRecord``.
+        """
+
+        compiled_rules = process_rules(rules, check)
+
+        if not rules:
+            self.target.log.error("No working rules found in '%s'", ",".join(rules))
+            return
+
+        if hasattr(compiled_rules, "warnings") and (num_warns := len(compiled_rules.warnings)) > 0:
+            self.target.log.warning("YARA generated %s warnings while compiling rules", num_warns)
+            for warning in compiled_rules.warnings:
+                self.target.log.debug(warning)
+
+        self.target.log.warning("Will not scan files larger than %s MB", max_size // 1024 // 1024)
+
+        for _, _, files in self.target.fs.walk_ext(path):
+            for file in files:
+                try:
+                    if file_size := file.stat().st_size > max_size:
+                        self.target.log.debug(
+                            "Skipping file '%s' as it is larger than %s bytes (size is %s)", file, file_size, max_size
+                        )
+                        continue
+
+                    buf = file.open().read()
+                    for match in compiled_rules.match(data=buf):
+                        yield YaraMatchRecord(
+                            path=self.target.fs.path(file.path),
+                            digest=hashutil.common(BytesIO(buf)),
+                            rule=match.rule,
+                            tags=match.tags,
+                            namespace=match.namespace,
+                            _target=self.target,
+                        )
+
+                except FileNotFoundError:
+                    continue
+                except RuntimeWarning as e:
+                    self.target.log.warning("Runtime warning while scanning file '%s': %s", file, e)
+                except Exception as e:
+                    self.target.log.error("Exception scanning file '%s'", file)
+                    self.target.log.debug("", exc_info=e)
+
+
+def process_rules(paths: list[str | Path], check: bool = False) -> yara.Rules | None:
+    """Generate compiled YARA rules from the given path(s).
+
+    Provide path to one (compiled) YARA file or directory containing YARA files.
+
+    Args:
+        paths: Path to file(s) or folder(s) containing YARA files.
+        check: Attempt to compile every rule file before appending to rules.
+
+    Returns:
+        Compiled YARA rules or None.
+    """
+    files = set()
+    compiled_rules = None
+
+    for rules_path in paths:
+        if isinstance(rules_path, str):
+            rules_path = Path(rules_path)
+
+        if not rules_path.exists():
+            log.warning("File %s does not exist!", rules_path)
+            continue
+
+        if rules_path.is_dir():
+            for file in rules_path.rglob("*"):
+                if not file.is_file():
+                    continue
+                files.add(file)
+        else:
+            files.add(rules_path)
+
+    for file in set(files):
+        with file.open("rb") as fh:
+            magic = fh.read(4)
+
+        if magic == b"YARA":
+            if len(files) > 1:
+                log.error("Providing multiple compiled YARA files is not supported. Did not add %s", file)
+                continue
+            else:
+                log.info("Adding single compiled YARA file %s", file)
+                compiled_rules = compile_yara(file, is_compiled=True)
+                break
+
+        elif check and not is_valid_yara({"check_namespace": file}):
+            log.warning("File %s contains invalid rule(s)!", file)
+            files.remove(file)
+            continue
+
+    if files and not compiled_rules:
+        try:
+            compiled_rules = compile_yara({hashlib.md5(file.as_posix().encode()).hexdigest(): file for file in files})
+        except yara.Error as e:
+            log.error("Failed to compile YARA file(s): %s", e)
+
+    return compiled_rules
+
+
+def compile_yara(files: dict[str, Path] | Path, is_compiled: bool = False) -> yara.Rules | None:
+    """Compile or load the given YARA file(s) to rules."""
+    if is_compiled and isinstance(files, Path):
+        return yara.load(files.as_posix())
+    else:
+        return yara.compile(filepaths={ns: Path(path).as_posix() for ns, path in files.items()})
+
+
+def is_valid_yara(files: dict[str, Path] | Path, is_compiled: bool = False) -> bool:
+    """Determine if the given YARA file(s) compile without errors or warnings."""
+    try:
+        compile_yara(files, is_compiled)
+        return True
+
+    except (yara.SyntaxError, yara.WarningError, yara.Error) as e:
+        log.debug("Rule file(s) '%s' invalid: %s", files, e)
+        return False

{dissect_target-3.19.dev21 → dissect_target-3.19.dev23}/dissect/target/plugins/os/unix/linux/_os.py

@@ -41,7 +41,7 @@ class LinuxPlugin(UnixPlugin, LinuxNetworkManager):
             for ip in ip_set:
                 ips.append(ip)
 
-        for ip in parse_unix_dhcp_log_messages(self.target):
+        for ip in parse_unix_dhcp_log_messages(self.target, iter_all=False):
             if ip not in ips:
                 ips.append(ip)
 

dissect_target-3.19.dev23/dissect/target/tools/yara.py

@@ -0,0 +1,61 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+import argparse
+import logging
+
+from dissect.target import Target
+from dissect.target.exceptions import TargetError
+from dissect.target.plugins.filesystem.yara import HAS_YARA, YaraPlugin
+from dissect.target.tools.query import record_output
+from dissect.target.tools.utils import (
+    catch_sigpipe,
+    configure_generic_arguments,
+    process_generic_arguments,
+)
+
+log = logging.getLogger(__name__)
+
+
+@catch_sigpipe
+def main():
+    help_formatter = argparse.ArgumentDefaultsHelpFormatter
+    parser = argparse.ArgumentParser(
+        description="target-yara",
+        fromfile_prefix_chars="@",
+        formatter_class=help_formatter,
+    )
+
+    parser.add_argument("targets", metavar="TARGETS", nargs="*", help="Targets to load")
+    parser.add_argument("-s", "--strings", default=False, action="store_true", help="print output as string")
+
+    for args, kwargs in getattr(YaraPlugin.yara, "__args__", []):
+        parser.add_argument(*args, **kwargs)
+
+    configure_generic_arguments(parser)
+
+    args = parser.parse_args()
+    process_generic_arguments(args)
+
+    if not HAS_YARA:
+        log.error("yara-python is not installed: pip install yara-python")
+        parser.exit(1)
+
+    if not args.targets:
+        log.error("No targets provided")
+        parser.exit(1)
+
+    try:
+        for target in Target.open_all(args.targets):
+            target.log.info("Scanning target")
+            rs = record_output(args.strings, False)
+            for record in target.yara(args.rules, args.path, args.max_size, args.check):
+                rs.write(record)
+
+    except TargetError as e:
+        log.error(e)
+        log.debug("", exc_info=e)
+        parser.exit(1)
+
+
+if __name__ == "__main__":
+    main()

{dissect_target-3.19.dev21 → dissect_target-3.19.dev23/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.19.dev21
+Version: 3.19.dev23
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.19.dev21 → dissect_target-3.19.dev23}/dissect.target.egg-info/SOURCES.txt

@@ -345,6 +345,7 @@ dissect/target/tools/query.py
 dissect/target/tools/reg.py
 dissect/target/tools/shell.py
 dissect/target/tools/utils.py
+dissect/target/tools/yara.py
 dissect/target/tools/dump/__init__.py
 dissect/target/tools/dump/run.py
 dissect/target/tools/dump/state.py
@@ -586,6 +587,7 @@ tests/tools/test_query.py
 tests/tools/test_reg.py
 tests/tools/test_shell.py
 tests/tools/test_utils.py
+tests/tools/test_yara.py
 tests/volumes/__init__.py
 tests/volumes/test_bde.py
 tests/volumes/test_md.py

{dissect_target-3.19.dev21 → dissect_target-3.19.dev23}/dissect.target.egg-info/entry_points.txt

@@ -8,3 +8,4 @@ target-mount = dissect.target.tools.mount:main
 target-query = dissect.target.tools.query:main
 target-reg = dissect.target.tools.reg:main
 target-shell = dissect.target.tools.shell:main
+target-yara = dissect.target.tools.yara:main

{dissect_target-3.19.dev21 → dissect_target-3.19.dev23}/pyproject.toml

@@ -133,6 +133,7 @@ target-mount = "dissect.target.tools.mount:main"
 target-query = "dissect.target.tools.query:main"
 target-reg = "dissect.target.tools.reg:main"
 target-shell = "dissect.target.tools.shell:main"
+target-yara = "dissect.target.tools.yara:main"
 
 [tool.black]
 line-length = 120

dissect_target-3.19.dev23/tests/plugins/filesystem/test_yara.py

@@ -0,0 +1,89 @@
+from __future__ import annotations
+
+import tempfile
+from io import BytesIO
+from pathlib import Path
+from typing import Iterator
+
+import pytest
+
+from dissect.target import Target
+from dissect.target.filesystem import VirtualFilesystem
+from dissect.target.plugins.filesystem.yara import HAS_YARA, YaraPlugin, is_valid_yara
+from tests._utils import absolute_path
+
+if HAS_YARA:
+    import yara
+
+rule_file = absolute_path("_data/plugins/filesystem/yara/rule.yar")
+another_rule_file = absolute_path("_data/plugins/filesystem/yara/another.yar")
+invalid_rule = absolute_path("_data/plugins/filesystem/yara/invalid.yar")
+rule_dir = Path(rule_file).parent
+
+
+@pytest.fixture
+def target_yara(target_default: Target) -> Iterator[Target]:
+    vfs = VirtualFilesystem()
+    vfs.map_file_fh("test_file", BytesIO(b"test string"))
+    vfs.map_file_fh("/test/dir/to/test_file", BytesIO(b"test string"))
+    vfs.map_file_fh("should_not_hit", BytesIO(b"this is another file."))
+    target_default.fs.mount("/", vfs)
+    target_default.add_plugin(YaraPlugin)
+    yield target_default
+
+
+@pytest.mark.skipif(not HAS_YARA, reason="requires python-yara")
+def test_yara_plugin(target_yara: Target) -> None:
+    results = list(target_yara.yara(rules=[Path(rule_file)]))
+
+    assert len(results) == 2
+    assert results[0].path == "/test_file"
+    assert results[1].path == "/test/dir/to/test_file"
+    assert results[0].rule == "test_rule_name"
+
+
+@pytest.mark.skipif(not HAS_YARA, reason="requires python-yara")
+@pytest.mark.parametrize(
+    "rules,expected_hits,should_be_valid",
+    [
+        (["/does/not/exist"], 0, False),
+        ([rule_file, rule_file], 2, True),
+        ([rule_file, another_rule_file], 4, True),
+        ([rule_dir], 4, False),  # contains invalid.yar
+        ([invalid_rule], 0, False),
+    ],
+)
+def test_yara_plugin_invalid_rules(
+    target_yara: Target, rules: list[str | Path], expected_hits: int, should_be_valid: bool
+) -> None:
+    assert is_valid_yara(files={str(file): file for file in rules}) == should_be_valid
+
+    results = list(target_yara.yara(rules=rules, check=True))
+    assert len(results) == expected_hits
+
+
+@pytest.mark.skipif(not HAS_YARA, reason="requires python-yara")
+def test_yara_plugin_invalid_rule_warn(target_yara: Target, caplog: pytest.CaptureFixture) -> None:
+    results = list(target_yara.yara(rules=[invalid_rule, another_rule_file], check=True))
+    assert "invalid.yar contains invalid rule(s)!" in caplog.text
+    assert len(results) == 2
+
+
+@pytest.mark.skipif(not HAS_YARA, reason="requires python-yara")
+def test_yara_plugin_compiled_rule(target_yara: Target, tmp_path: str) -> None:
+    with tempfile.NamedTemporaryFile(mode="w", dir=tmp_path, delete=False) as tf:
+        rules = yara.compile(rule_file)
+        rules.save(tf.name)
+        tf.close()
+
+        results = list(target_yara.yara(rules=[tf.name]))
+
+        assert len(results) == 2
+
+        assert results[0].path == "/test_file"
+        assert results[0].rule == "test_rule_name"
+        assert results[0].tags == ["tag1", "tag2", "tag3"]
+        assert results[0].namespace == "default"
+        assert results[0].digest.md5 == "6f8db599de986fab7a21625b7916589c"
+        assert results[0].digest.sha1 == "661295c9cbf9d6b2f6428414504a8deed3020641"
+        assert results[0].digest.sha256 == "d5579c46dfcc7f18207013e65b44e4cb4e2c2298f4ac457ba8f82743f31e930b"

{dissect_target-3.19.dev21 → dissect_target-3.19.dev23}/tests/plugins/os/unix/test_ips.py

@@ -1,5 +1,6 @@
 import textwrap
 from io import BytesIO
+from unittest.mock import patch
 
 import pytest
 
@@ -7,21 +8,40 @@ from dissect.target import Target
 from dissect.target.filesystem import VirtualFilesystem
 from dissect.target.helpers.network_managers import NetworkManager
 from dissect.target.plugins.os.unix.linux._os import LinuxPlugin
+from dissect.target.tools.query import main as target_query
 from tests._utils import absolute_path
 
 
-def test_ips_dhcp(target_unix_users: Target, fs_unix: VirtualFilesystem) -> None:
+@pytest.mark.parametrize(
+    "expected_ips, messages",
+    [
+        (
+            ["10.13.37.1"],
+            "Jan  1 13:37:01 hostname NetworkManager[1]: <info>  [1600000000.0000] dhcp4 (eth0): option ip_address           => '10.13.37.1'",  # noqa: E501
+        ),
+        (["10.13.37.2"], "Feb  2 13:37:02 test systemd-networkd[2]: eth0: DHCPv4 address 10.13.37.2/24 via 10.13.37.0"),
+        (
+            ["10.13.37.3"],
+            "Mar  3 13:37:03 localhost NetworkManager[3]: <info>  [1600000000.0003] dhcp4 (eth0):   address 10.13.37.3",
+        ),
+        (
+            ["10.13.37.4"],
+            "Apr  4 13:37:04 localhost dhclient[4]: bound to 10.13.37.4 -- renewal in 1337 seconds.",
+        ),
+        (
+            ["2001:db8::"],
+            (
+                "Jun  6 13:37:06 test systemd-networkd[5]: eth0: DHCPv6 address 2001:db8::/64 via 2001:db8:ffff:ffff:ffff:ffff:ffff:ffff\n"  # noqa: E501
+                "May  5 13:37:05 test systemd-networkd[5]: eth0: DHCPv6 lease lost\n"
+            ),
+        ),
+    ],
+)
+def test_ips_dhcp(
+    target_unix_users: Target, fs_unix: VirtualFilesystem, expected_ips: list[str], messages: str
+) -> None:
     """Test DHCP lease messages from /var/log/syslog."""
 
-    messages = """
-    Jan  1 13:37:01 hostname NetworkManager[1]: <info>  [1600000000.0000] dhcp4 (eth0): option ip_address           => '10.13.37.1'
-    Feb  2 13:37:02 test systemd-networkd[2]: eth0: DHCPv4 address 10.13.37.2/24 via 10.13.37.0
-    Mar  3 13:37:03 localhost NetworkManager[3]: <info>  [1600000000.0003] dhcp4 (eth0):   address 10.13.37.3
-    Apr  4 13:37:04 localhost dhclient[4]: bound to 10.13.37.4 -- renewal in 1337 seconds.
-    May  5 13:37:05 test systemd-networkd[5]: eth0: DHCPv6 lease lost
-    Jun  6 13:37:06 test systemd-networkd[5]: eth0: DHCPv6 address 2001:db8::/64 via 2001:db8:ffff:ffff:ffff:ffff:ffff:ffff
-    """  # noqa E501
-
     fs_unix.map_file_fh(
         "/var/log/syslog",
         BytesIO(textwrap.dedent(messages).encode()),
@@ -30,8 +50,53 @@ def test_ips_dhcp(target_unix_users: Target, fs_unix: VirtualFilesystem) -> None
     target_unix_users.add_plugin(LinuxPlugin)
     results = target_unix_users.ips
     results.reverse()
-    assert len(results) == 5
-    assert sorted(results) == ["10.13.37.1", "10.13.37.2", "10.13.37.3", "10.13.37.4", "2001:db8::"]
+    assert len(results) == len(expected_ips)
+    assert sorted(results) == expected_ips
+
+
+@pytest.mark.parametrize(
+    "flag, expected_out",
+    [
+        (None, "['10.13.37.2']"),
+        # ("--dhcp-all", "['10.13.37.2', '10.13.37.1']"),
+        # Temporarily disabled behaviour, for discussion see:
+        # https://github.com/fox-it/dissect.target/pull/687#discussion_r1698515269
+    ],
+)
+def test_ips_dhcp_arg(
+    target_unix: Target,
+    fs_unix: VirtualFilesystem,
+    flag: str,
+    expected_out: str,
+    capsys: pytest.CaptureFixture,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Test --dhcp-all flag behaviour"""
+
+    fs_unix.map_file_fh("/etc/timezone", BytesIO(b"Europe/Amsterdam"))
+
+    messages = """
+    Apr  1 13:37:01 localhost dhclient[4]: bound to 10.13.37.1 -- renewal in 1337 seconds.
+    Apr  2 13:37:02 localhost foo[1]: some other message.
+    Apr  3 13:37:03 localhost dhclient[4]: bound to 10.13.37.2 -- renewal in 1337 seconds.
+    """
+
+    fs_unix.map_file_fh(
+        "/var/log/syslog",
+        BytesIO(textwrap.dedent(messages).encode()),
+    )
+    target_unix.add_plugin(LinuxPlugin)
+
+    argv = ["target-query", "foo", "-f", "ips"]
+    if flag:
+        argv.append(flag)
+
+    with patch("dissect.target.Target.open_all", return_value=[target_unix]):
+        with monkeypatch.context() as m:
+            m.setattr("sys.argv", argv)
+            target_query()
+            out, _ = capsys.readouterr()
+            assert expected_out in out
 
 
 def test_ips_cloud_init(target_unix_users: Target, fs_unix: VirtualFilesystem) -> None:

dissect_target-3.19.dev23/tests/tools/test_yara.py

@@ -0,0 +1,43 @@
+from io import BytesIO
+from unittest.mock import patch
+
+import pytest
+
+from dissect.target import Target
+from dissect.target.filesystem import VirtualFilesystem
+from dissect.target.tools.yara import HAS_YARA
+from dissect.target.tools.yara import main as target_yara
+from tests._utils import absolute_path
+
+
+@pytest.mark.skipif(not HAS_YARA, reason="requires python-yara")
+def test_yara(target_default: Target, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture) -> None:
+    vfs = VirtualFilesystem()
+    vfs.map_file_fh("test_file", BytesIO(b"hello there this is a test string!"))
+    vfs.map_file_fh("/test/dir/to/test_file", BytesIO(b"this is another test string for YARA testing."))
+    vfs.map_file_fh("should_not_hit", BytesIO(b"this is another file."))
+    target_default.fs.mount("/", vfs)
+
+    with patch("dissect.target.Target.open_all", return_value=[target_default]), monkeypatch.context() as m:
+        m.setattr(
+            "sys.argv",
+            [
+                "target-yara",
+                "example.img",
+                "--rules",
+                absolute_path("_data/plugins/filesystem/yara/rule.yar"),
+                "--path",
+                "/",
+                "--check",
+                "-s",
+            ],
+        )
+        target_yara()
+
+        out, _ = capsys.readouterr()
+
+        hit1 = "<filesystem/yara/match hostname=None domain=None path='/test_file' digest=(md5=d690ba32b59d28614aebefe9b03c74d4, sha1=4b1ced217aabe37138e96fb93bf40026639b9d3b, sha256=7a644118588ff0dcf2fadbe198ae1f1629c29374bac491ba41d5cf957edf0dfc) rule='test_rule_name' tags=['tag1', 'tag2', 'tag3']"  # noqa E501
+        hit2 = "<filesystem/yara/match hostname=None domain=None path='/test/dir/to/test_file' digest=(md5=bd7490dd2978ce983e2e1613ac8444c0, sha1=849a062cf09280f5c7dce4c7f87c69a1d9262e08, sha256=9bf7629a67c7ce8019910f1c1251fe44b61b3fff55a59a5e148af3c207dc102f) rule='test_rule_name' tags=['tag1', 'tag2', 'tag3']"  # noqa E501
+
+        assert hit1 in out
+        assert hit2 in out