Detecting potential threats using YARA rules

To start using YARA, you can download the most recent version from https://github.com/VirusTotal/yara/releases:

1. In this case, we will use YARA v4.2.0, which can be downloaded directly from here: https://github.com/VirusTotal/yara/releases/download/v4.2.0/yara-v4.2.0-1885-win64.zip.
2. Once you have downloaded the tool, unzip the .zip file into a new directory called yara, as shown in the C:\Users\Investigator\Workspace\Tools\yara path.

   Note

   You can add this directory to the environment variables of Windows to avoid explicitly specifying the path of YARA every time you execute a search using yara.

Once you have downloaded YARA, you are ready to create your first detection rule.

Open VS Code, click on the File menu, and select New File.

Now, click again on the File menu and select Save As….

3. When the dialog box appears, change the save path to the C:\Users\Investigator\Workspace\Labs\Chapter_13 directory.
...