This rule will find PE files that contain PDB paths. These paths can be useful for malware analysis in a number of ways as outlined in this FireEye blog post: https://www.fireeye.com/blog/threat-research/2019/10/definitive-dossier-of-devilish-debug-details-part-deux.html

This rule requires YARA version 4.0.0+: https://yara.readthedocs.io/en/stable/modules/pe.html

import "pe"

rule contains_pdb_path
{
	meta:
		description = "PE file containing PDB path"
		prereq = "Requires yara v4.0.0+"

	condition:
		pe.pdb_path
}

YARA Rules Index