Blog

Filter: write - Clear Filter

50 Shades of YARA

by Florian Roth | Jan 2, 2019

A long time ago I've noticed that there is no single best YARA rule for a given sample, but different best solutions depending on the user's requirements and use case. I noticed that I often create 2 to 3 YARA rules for a single sample that I process, while each of...

How to Write Simple but Sound Yara Rules

by Florian Roth | Feb 16, 2015

During the last 2 years I wrote approximately 2000 Yara rules based on samples found during our incident response investigations. A lot of security professionals noticed that Yara provides an easy and effective way to write custom rules based on strings or byte...