Life After Yara

No ratings

Presented at Bsidescanberra 2017 by

Yara rules are widely used to quickly search for malware samples and memory dumps. Though these rules are easy to create, they are also very brittle. Since the rules are essentially regular expressions over byte sequences, they can be rendered ineffective by very small changes in the byte ordering, such as due to reordering of a few instructions in polymorphic malware. This presentation looks at semantic alternatives to yara rules and examines whether they are ready for industry use. Though polymorphic malware have different byte ordering, or even different bytes, the underlying semantics of their instructions remain unchanged. The challenge is in extracting the semantics and using the semantics to search. The presentation will present results of some recent advances that make such semantics based searching possible.