rules to identify files containing juicy information like usernames, passwords etc
Remember that depending on the YARA version or operating system that you use, the syntax might vary slightly.
yara -r juicy_files.txt <location>
yara -t <tag> -r juicy_files.txt <location>
yara -i <rule identifier/name> -r juicy_files.txt <location>
~/Desktop/yara4pentesters$ yara -r juicy_files.txt ../y4p_files
shadow_file ../y4p_files/shadow
hive_file ../y4p_files/mysecurity
hive_file ../y4p_files/mysam
hive_file ../y4p_files/system
hive_file ../y4p_files/mysystem
ntds_file ../y4p_files/ntds.dit
~/Desktop/yara4pentesters$ yara -t linux -r juicy_files.txt ../y4p_files
shadow_file ../y4p_files/shadow
~/Desktop/yara4pentesters$ yara -i ntds_file -r juicy_files.txt ../y4p_files
ntds_file ../y4p_files/ntds.dit