Simple definition
YARA is a concept or mechanism used in cybersecurity to describe patterns that allow for, identify suspicious files or contents.
Technical definition
In a business environment, YARA intervenes mainly to describe patterns allowing to identify suspicious files or contents. Its implementation depends on the architecture, equipment and security policies in place.
What’s the point?…
describe patterns that allow for, identify suspicious files or contents.
Concrete example
a YARA rule searches for multiple PE strings and properties.
Common problems
- too permissive rule
- cost of scan
- obfuscation
To be noted: Always adapt the diagnosis to the version of the product and to the architecture actually deployed.