Anti Yara Rules

Created the Tuesday 10 November 2020. Updated 5 months, 3 weeks ago.

Yara rules are used by malware researchers to identify and classify malware based on specific characteristics and behaviors. These rules are powerful because they allow researchers to quickly and accurately detect malware, even if it has been modified to avoid detection. However, attackers can also modify their malware to avoid detection by Yara rules.

This is often seen with ransomware, where attackers will update the content of their ransom notes in an attempt to evade detection. By constantly modifying their malware, attackers can make it more difficult for researchers to track and detect their malware.

Technique Identifier

U1001

Technique Tags

Yara rules tracking detection evasion ransomware notes malware classification malware characteristics malware behaviors

Contributors

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

GitHub - Yara-Rules/rules: Repository of yara rules