Terminology Index

Glossary

2 terms starting with "Y"

Showing 1-2 of 2 terms

Yara Rules

Pattern-matching rules for identifying malware and files of interest by content, strings, byte patterns, conditions, used widely in malware analysis, hunting, and incident response.

Yara String Selection

The craft of choosing strings for YARA rules that are distinctive, durable, and unlikely to false-positive, the difference between a rule that catches a family and one that catches noise.

Writing good YARA rules depends heavily on which strings you choose. Good strings are distinctive to the target (unusual function names, unique error messages, format strings), durable (likely to survive small recompiles), and unlikely to appear in unrelated benign software. Bad strings (overly generic, version-specific, easy to obfuscate) yield brittle rules. As a malware-analysis-fundamentals topic, YARA string selection is one of the higher-craft skills that distinguishes effective rule authors.

Introduced in: Applied Malware Analysis for Defenders

Examples

Picking distinctive, unusual function names rather than common library strings.
Choosing strings that survive small recompiles for durability.
Avoiding strings that show up commonly in benign software.

soc advanced yara-string-selection

No related terms linked yet.