# CLI

```text
usage: A YARA scanner for emails [-h] [-V] [-v] [-m] [-o] [-r] [-b] [-s] [-t]
                                 [--output OUTPUT] [--rules RULES]
                                 [--header-rules HEADER_RULES]
                                 [--body-rules BODY_RULES]
                                 [--header-body-rules HEADER_BODY_RULES]
                                 [--attachment-rules ATTACHMENT_RULES]
                                 [--passwords PASSWORDS]
                                 [--implicit-safe-domains IMPLICIT_SAFE_DOMAINS]
                                 [--max-zip-depth MAX_ZIP_DEPTH]
                                 scan_path

positional arguments:
  scan_path             The file(s) to scan. Wildcards allowed. Use - to read
                        from stdin. When used with -t/--test, this must be the
                        directory where samples are stored, instead of an
                        individual file or wildcard path.

options:
  -h, --help            show this help message and exit
  -V, --version         show program's version number and exit
  -v, --verbose         Output the entire parsed email. When used with
                        -t/--test, this option outputs passing results along
                        with failing results. (default: False)
  -m, --multi-auth      Allow multiple Authentication-Results headers
                        (default: False)
  -o, --auth-original   Use Authentication-Results-Original instead of
                        Authentication-Results (default: False)
  -r, --raw-headers     Scan headers with indentations included (default:
                        False)
  -b, --raw-body        Scan the raw email body instead of converting it to
                        Markdown first (default: False)
  -s, --sld             Use From domain the Second-Level Domain (SLD) for
                        authentication in addition to the Fully-Qualified
                        Domain Name (FQDN) (default: False)
  -t, --test            Test rules based on verdicts matching the name of the
                        subdirectory a sample is in (default: False)
  --output OUTPUT       Redirect output to a file (default: None)
  --rules RULES         A path to a directory that contains YARA rules
                        (default: .)
  --header-rules HEADER_RULES
                        Filename of the header rules file (default:
                        header.yar)
  --body-rules BODY_RULES
                        Filename of the body rules file (default: body.yar)
  --header-body-rules HEADER_BODY_RULES
                        Filename of the header_body rules file (default:
                        header_body.yar)
  --attachment-rules ATTACHMENT_RULES
                        Filename of the attachment rules file (default:
                        attachment.yar)
  --passwords PASSWORDS
                        Filename of a list of passwords to try against
                        password-protected files in addition to email body
                        content (default: passwords.txt)
  --implicit-safe-domains IMPLICIT_SAFE_DOMAINS
                        Filename of a list of message From domains that return
                        a safe verdict if the domain is authenticated and no
                        YARA categories match other than safe (default:
                        implicit_safe_domains.txt)
  --max-zip-depth MAX_ZIP_DEPTH
                        The maximum number of times to recurse into nested ZIP
                        files (default: None)
```