Kicking YARA Series – YARA Post #1
For the last few years I have been working in Product Management at Rubrik. One of the offerings I recently launched was the ability to scan backups of different systems looking for Indicators of...
View ArticleYARA BlackCat Payload Example – YARA Post #2
In my first post in this series, Day 1 of the 12 Days of YARA, I shared some resources that can help you to get started with YARA. YARA is a rules based language that allows for pattern matching...
View ArticleXProtect & YARA – YARA Post #3
In yesterday’s post I covered an example of a YARA rule from AT&T’s Alien Labs used to detect payloads used by BlackCat Ransomware. Today I’ll take a quick look at one of the YARA rules used by...
View ArticleReading ZIP (JAR) Files with YARA (part 1) – YARA Post #4
ZIP files have a well defined structure, this makes it possible to use YARA to match certain characteristics of files stored within the ZIP file. For example file name information is stored in both...
View ArticleLearning from Others – YARA Post #5
Taking a quick break from my Zip Archive adventures, one thing I’d be remiss not to mention is the community sharing that happens around YARA. As well as the specific YARA rules that people share,...
View ArticleAnalyzing ZIP Files with YARA (part 2) – YARA Post #6
In my first exploration of analyzing ZIP files with YARA I covered how we could create a YARA rule that matched on specific file names within the ZIP archive, in this post we’ll cover a few other...
View ArticleAnalyzing ZIP (OOXML) Files with YARA (part 3) – YARA Post #7
My prior posts about examining ZIP archives have covered matching the file names within a ZIP archive, as well as matching the pre-compression CRC values of the files within the archive. In this blog...
View ArticleScheduled Tasks – YARA Post #8
Today I’ll share just a short snippet that I used to look for some specific scheduled tasks on a Windows system. Luckily windows creates XML files that are located somewhere like the...
View ArticleYARA Performance – YARA Post #9
Just a brief pointer to a useful write up of some YARA performance guides today – https://github.com/Neo23x0/YARA-Performance-Guidelines/blob/master/README.md This write up contains a lot of good...
View Article
