Detecting Malicious Files with YARA Rules as They Traverse the Network
summary
Integrates Zeek IDS file extraction with YARA rules plus a custom Python daemon that scans extracted files every minute, copies matches to long-term storage and emails contextual alerts (IP, URL, user‑agent); extracts targeted MIME types (DOC/DOCX, PDF, RTF, compressed, text) to reduce load; demo shows detection of a macro‑enabled Word payload before widespread harm; attachments under a size threshold are passworded for analysis; successful 1‑minute polling in tests but SSL payloads require decryption and MIME selection trades off coverage versus retention.
AI-written summary · about
chapters (5)
related talks
48m"Utilizing YARA to Find Evolving Malware"
26mResource Efficient Malware Scans with YARA + osquery
47mDetecting and analyzing files-less malware
42mYAMAGoya: Open Source Threat Hunting Tool using YARA and SIGMA
33mBasic Malware Analysis for Incident Responders
58mHunting Malware with Suricata Metadata
01h 03mEffects Malware hunting in Cloud environment
40mAnalyzing Windows Malware on Linux: Getting Started Tips and Examples