
Understand why hashing falls short and how Yara pattern matching detects malware using strings with modifiers, hex, and regular expressions, including no case, full word, and wide for Unicode.
Explore how file headers and bodies reveal file type using magic numbers, such as 4D5A for Windows executables, and JPEG start bytes to set the right context for Yara rules.
Identify a Yara rule using the magic number at position zero. Compare strings-based and hex-based identification, and test against executables with positive and negative outcomes.
Explore the additional content section with student questions, requests, demonstrations, and material not in the initial deadline, plus new resources, code, and cheat sheets; check back often.
Use Yara to identify potentially malicious software by installing and running it. Understand hashing and pattern matching, and design practical Yara rules for threat hunting.
In this course, you'll quickly learn to use YARA for identifying potentially malicious pieces of software.
Traditional hash-based malware detections can be easily defeated and are sometimes unreliable. Malware creators use a variety of tactics to devise new malware variants that evade traditional detection. To overcome the limitations of hash-based matching, YARA gives you a full-feature pattern matching framework.
Learn how to leverage YARA's capabilities to help fill the gaps in your malware analysis process, enabling you to better detect and respond to malware incidents.
Key topics topics and basic skills that you'll develop are:
Gain an understanding of how hashing and pattern matching work
Become familiar with YARA as a pattern-matching framework
Install YARA on your system
Learn the syntax for writing YARA rules
Create your own basic and more advanced rules
Discover how to write effective rules with practical examples
Create a rule to look for Web Shells
Design and implement a rule to look for ransomware
And more!
When you're finished with the course, you'll have the basic skills and knowledge to start writing YARA rules to assist with detection and response to malware incidents.
Quickly learn the right YARA skills to give your threat hunting and malware analysis skills a huge boost in efficiency and effectiveness!