Hot answers tagged

6

An additional source of such samples, which I don't know why nobody listed, is virustotal.com. It lets you execute what they call "ruleset" and "retrohunt" searches which are basically running yara rules on every sample processed through virustotal and every sample from the last 3 months. This is a paid service but it's definitely worth it. Here's an image ...


3

afaik shadowserver offers a service like this to business partners (you send yara rules and get matching samples from honeypots in return), but there is no such service for free or personal use. You can try to set up your won honeypot for current malware samples (there is a broad range of software for this) or try to run your yara rules on your own malware ...


2

So let me google that for you... What about: https://github.com/Neo23x0/signature-base/tree/master/yara https://github.com/Yara-Rules/rules use clamav_to_yara.py use https://www.yara-generator.net/


2

From Oreans KB: The Taggant System is a cryptographic signature added to a software to fight against antivirus false positives in protected applications. The Taggant information in your Themida/WinLicense license contains an internal ID and your private key to insert and sign the protected binary with your Taggant information, so antivirus ...


1

Agree with Robert - The common way to avoid false positives is having a large software pool of known benign software you can check your rules with. If you are just starting to write yara rules then concentrate on the easy way that is strings, write yara rules based on the unique strings. To answer this: Can anyone tell me which code is suitable and which ...


1

WXS on the Yara Google Groups was kind enough to post an answer to this question. He has several examples here: https://gist.github.com/wxsBSD/4d5d7677578f80cdf82a


Only top voted, non community-wiki answers of a minimum length are eligible