"Utilizing YARA to Find Evolving Malware"

on YouTube ↗48m

" summary

Shows how to build YARA rules that survive string obfuscation by matching reused machine code rather than literals, using wildcards for registers and offsets and brackets to skip variable opcodes. Describes managing four datasets — small clean / large clean / malicious / random — and testing rules before deployment, warns about over-wildcarding (once pegges VirusTotal CPU). Demonstrates hitting both an array-initialized string sample and plain-string sample, and finds new variants from APT15 / Mirage by extracting unique code snippets and deploying code-based YARA rules.

AI-written summary · about

" chapters (13)

1. 0:00Introduction to YARA
2. 1:54YARA basics and syntax
3. 3:44PE module and header checks
4. 4:54Building and managing data sets
5. 7:04Data sources for malware samples
6. 8:53Managing YARA rules with Clara
7. 10:03Threat hunting vs detection
8. 12:17Step-by-step rule building process
9. 14:26String rules vs code-based rules
10. 16:19Demo: Building a code-based rule
11. 31:23Case study: APT 15 Mirage malware
12. 40:58Key takeaways and best practices
13. 42:27Q&A session

" related talks

• 47mWorm Charming: Harvesting Malware Lures for Fun and ProfitPedram Amini · Black Hat USA 2019
• 26mResource Efficient Malware Scans with YARA + osqueryJulian Wayte · osquery@scale 2020
• 20mDetecting Malicious Files with YARA Rules as They Traverse the NetworkDavid Bernal · Black Hat USA 2019
• 33mBasic Malware Analysis for Incident RespondersJared Graff · BSides Tampa 2024
• 40mAnalyzing Windows Malware on Linux: Getting Started Tips and ExamplesLenny Zeltser · RSAC 2021
• 47mDetecting and analyzing files-less malwareChristopher Williams, Evan Wagner · BSides Tampa 2021
• 23mThe Convergence Of EBPF, Buildroot, And QEMU For Automated Linux Malware AnalysisNikhil Hegde · Nullcon Goa 2023
• 30mTrawling for IOCs: Catching C2 in a Sea of DataMoses Schwartz · BSidesSF 2025