YARA rules are used to classify and identify malware samples by creating descriptions of malware families based on textual or binary patterns. YARA rules are malware detection patterns that are fully customizable to identify targeted attacks and security threats specific to your environment. There are many detection tools, EDR, IR application uses this awesome tool to increase their capability in DFIR. While we work on incident response, it’s a must for us that we increase our learning scope and level up the game of technical aspect. Learning Yara will help you to level up your incident response skills.
Syllabus
- Introduction
- Basics about Yara
- Writing Yara Rule
- Strings in Yara
- Regular Expression Basics
- Yara in Incident Response
- Retro Threat-Hunt using Yara
- Yara in Memory Forensics
- Course Evaluation
