YARA

One tool that has made its way from the malware analysis community into threat intelligence is YARA. This open source tool is often compared to the Linux GREP command for its ability to parse through large amounts of data and indicate if there are matching strings or data patterns. What the acronym YARA stands for is the subject of friendly debate with some going with YARA: Another Recursive Acronym or the author’s preferred Yet Another Ridiculous Acronym. Nomenclature aside, the YARA tool’s ability to act as a Swiss Army knife for incident responders and malware research also has functionality that analysts can leverage.

The YARA tool is maintained by VirusTotal and comes in two components. The first of these is a scanning tool. This tool, written in Python, is the engine that scans files such as memory dumps, disk images, or suspected malicious executables for matching indicators. Due to the tool being open source, along with its capabilities, third-party tools...