YARA – The pattern matching swiss knife(github.com)
github.com
YARA – The pattern matching swiss knife
https://github.com/VirusTotal/yara
5 comments
The part of the docs i want to skim to see what it does is nicely on one page: https://yara.readthedocs.io/en/stable/writingrules.html
Yara happens to power XProtect, macOS’s malware detection tool. It’s production-ready ;)
Yes, XProtect is deployed to all macs, but XProtect has a very small [1] number of signatures (~four dozen), compared to any windows AV engine (which would have thousands of signatures at a minimum.) This can't be because only four dozen possible malware families affect macOS, but we can speculate that it is either a performance issue (good sigs are costly [CPU/io]), a signature writing issue (Apple needs more malware peeps), or an image issue (if Apple put 10k signatures in XProtect, it would be admitting that 10k families of malware exist for macOS.)
IMO, Apple needs to improve the macOS malware detection situation before we consider their implementation 'production ready.'
[1] Official XProtect configuration: https://configuration.apple.com/configurations/macosx/xprote...
IMO, Apple needs to improve the macOS malware detection situation before we consider their implementation 'production ready.'
[1] Official XProtect configuration: https://configuration.apple.com/configurations/macosx/xprote...
YARA has been a pleasure to work with ever since i switch from IDA with sigmaker to Ghidra with YaraGhidraGUI.
Really made me think of how to actually make patterns match asm by hand when needed.
Really made me think of how to actually make patterns match asm by hand when needed.
Perhaps it's just me but I would expect a "pattern matching swiss knife" to at least have some machine-learning capabilities.
should be backed by blockchain too
Also quantum something just in case
all powered by a fusion reactor
Don't forget Turing Complete AI-ng
Whoaa horsey! We don't want some vc guy to wet himself looking at this thread
yes, and a subscription-based cloud service
it must be Cloud-native, and Big Data ready
No one mentioned Rust, sooo... It's going to be written in Rust, isn't it?
https://github.com/airbnb/binaryalert