Using Yara Tags to Build a Heuristic Scanner
Jason Reaves · viXra · 2020
YARA is a tool that has been pretty heavily adopted within the Cyber Security community, it was built to aid malware researchers with identifying and classifying malicious objects[1]. Instead of approaching this problem with a purely good or bad mindset in detecting malicious objects, we can utilize added functionality of YARA, namely tags, to approach the problem of judging how malicious or suspicious an object is by looking at the problem in smaller sets. This concept is commonly used in heuristic engines used by antiviruses and sandboxes where you can give a weight of maliciousness to an object. The aim of this paper is to introduce a method for such an engine to be built by an organization utilizing existing software.