Digital Forensics and Incident Response - Second Edition

YARA

Another tool that responders should be familiar with when it comes to malware analysis is the pattern-matching tool YARA. YARA (short for Yet Another Ridiculous Acronym) is a schema to identify and classify malware, through the creation of text-based rules. YARA rules are a combination of strings and Boolean expressions that are married with a condition, to determine if a specific file has any of the attributes contained within the YARA rule. For example, the following is a YARA rule created by Florian Roth for the Stuxnet malware and is available at https://github.com/Yara-Rules/rules/blob/master/malware/APT_Stuxnet.yar. This rule has been written to examine a suspect file for full-word strings that are associated with the Stuxnet malware, ...