“yara”的搜索结果

Write and review YARA-X rules, which identify malware through file patterns. Refine detection strings and conditions, check rule quality with included scripts, test against clean files, improve performance, and migrate rules from legacy YARA.

中文简介正在准备中。当前显示英语简介。

• Write rules targeting a specific malware family
• Review false positives and slow detection rules
• Migrate existing YARA rules to YARA-X

Research malware families through Malpedia, connecting aliases, associated threat groups, and relationships between malware that loads other malware. Collect YARA rules, patterns used to identify malware, and organize references to support investigations and detection work.

中文简介正在准备中。当前显示英语简介。

• Resolving different vendor names for the same malware
• Mapping malware associated with a threat group
• Documenting chains in which malware loads other malware

Analyze suspected malware through code inspection and behavior observed in an isolated environment. Extract indicators of compromise, such as suspicious domains and file paths, and create YARA file-matching rules or Sigma behavior-detection rules from the findings.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious executables, scripts, and macros
• Extracting malicious domains, file paths, and other indicators
• Creating YARA and Sigma detection rules

Investigate signs of intrusion through hypothesis-led log searches, then turn findings into detection rules. Supports Sigma, YARA, and SIEM queries, with attention to false positives, data field mapping, and validation against historical logs.

中文简介正在准备中。当前显示英语简介。

• Hunting for intrusion signs in security logs
• Turning findings into Sigma or YARA rules
• Investigating false positives and tuning alerts

Extract Cobalt Strike Beacon settings from executable files and memory dumps to identify command-and-control servers, communication patterns, and identifying markers. Use the findings to compare samples, investigate incidents, and develop file and network detection rules.

中文简介正在准备中。当前显示英语简介。

• Extract Beacon settings from suspicious files
• Identify command-and-control servers and traffic patterns
• Compare samples using watermark identifiers

Uses YARA to classify and triage samples at scale: applying rule sets, reading matches and string offsets, tuning for false positives, and organizing rules for malware family identification. Activates for requests to scan files with YARA, apply YARA rules, or classify samples by signature.

中文简介正在准备中。当前显示原文说明。

Build and test threat detection rules in Google SecOps using YARA-L 2.0, its rule language. The skill also checks existing coverage with simulated attack events, proposes rules for confirmed gaps, and deploys approved rules.

中文简介正在准备中。当前显示英语简介。

• Creating detection rules from known attack behavior
• Tuning existing rules to reduce false positives
• Checking detection gaps against threat reports and CVE disclosures

Turns reverse-engineering findings into durable YARA detections: selecting stable code constructs and constants over volatile strings, extracting opcode/byte patterns with wildcards, and validating rules for low false positives. Activates for requests to write a YARA rule from reversed code, create a detection signature, or convert RE findings into hunting rules.

中文简介正在准备中。当前显示原文说明。

Guide malware cleanup on infected Windows and Linux systems after containment and investigation. Covers removing malicious files and mechanisms that preserve attacker access, rotating credentials, patching entry points, and documenting validation results before recovery.

中文简介正在准备中。当前显示英语简介。

• Cleaning infected systems after containment
• Removing mechanisms that preserve attacker access
• Rotating compromised credentials and fixing entry points

Turn cyber threat intelligence reports into a searchable library of attacker behaviors linked to MITRE ATT&CK techniques. Export structured STIX 2.1 data, a threat information exchange format, and create detection rule templates from documented activity.

中文简介正在准备中。当前显示英语简介。

• Cataloging attacker behaviors from threat intelligence reports
• Organizing attack patterns by tactic, technique, and threat actor
• Creating detection rule templates from documented behaviors

Observe malware in an isolated Cuckoo Sandbox environment and review its processes, network traffic, and system changes. Use the findings to trace infection stages, identify persistence mechanisms, and extract indicators of compromise for behavioral reports.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious files after static analysis
• Tracing multi-stage infections and persistence mechanisms
• Extracting indicators of compromise from observed behavior

Analyze captured RAM with Volatility to investigate suspicious processes, injected code, network connections, and other evidence of compromise. The skill guides memory investigations and organizes findings into timelines and reports, including malware traces absent from disk.

中文简介正在准备中。当前显示英语简介。

• Investigating fileless malware after an endpoint alert
• Finding hidden processes and injected code
• Linking suspicious processes to network connections

Use when the user asks for a YARA rule, "write YARA for this sample/family", or `/hash-investigation` / `/malware-analysis` surfaces a sample worth a static-content rule. Pattern-matching rules for identifying malicious files.

中文简介正在准备中。当前显示原文说明。

Investigate security incidents using memory dumps, saved copies of RAM. The skill guides memory acquisition, process and network analysis, suspicious code detection, and evidence extraction with Volatility and related tools, including checks for capture integrity.

中文简介正在准备中。当前显示英语简介。

• Capturing RAM before shutting down a system under investigation
• Finding suspicious processes and network connections in memory
• Extracting executables and strings for malware analysis

Analyze RAM dumps with Volatility 3 to investigate suspicious processes, network connections, injected code, and credential theft. Guides memory capture and evidence extraction, then organizes findings into a forensic report for incident response.

中文简介正在准备中。当前显示英语简介。

• Investigating malware that runs only in memory
• Checking suspicious processes and network connections
• Investigating signs of credential theft

Investigate malware that survives OS reinstallation by checking UEFI firmware, boot files, and Secure Boot settings. Use chipsec and supporting tools to compare trusted baselines, identify bootkit indicators, and document findings.

中文简介正在准备中。当前显示英语简介。

• Investigating reinfection after OS reinstallation
• Checking unexpected Secure Boot changes
• Comparing firmware against a trusted vendor baseline

Examine suspicious Word, Excel, and PowerPoint documents by extracting macros and untangling code designed to hide its purpose. Identify download addresses, execution triggers, and attack steps, then document findings and indicators for detecting related threats.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious email attachments
• Finding download addresses hidden in VBA code
• Examining legacy Excel 4.0 macros

Evaluate whether Google SecOps rules detect threats described in articles or supplied text. Generate simulated attack logs, identify coverage gaps, summarize matching rules, and create rules for uncovered threats, with user approval before adding them.

中文简介正在准备中。当前显示英语简介。

• Evaluate detection coverage for threats described in a blog
• Test existing rules with simulated attack logs
• Review matching rules and their alerting status

Static and dynamic malware analysis, YARA rule generation, sandbox configuration, behavioral profiling, and malware family classification

中文简介正在准备中。当前显示原文说明。

Detection engineering skill for writing, testing, and tuning Sigma, YARA, YARA-L, Suricata, Snort, Zeek, KQL, SPL, EQL, Chronicle, and Elastic detection rules. Covers ATT&CK coverage mapping, telemetry gap analysis, false-positive tuning, detection-as-code pipelines, and validation with Atomic Red Team and Caldera. Use to design durable detections backed by tests.

中文简介正在准备中。当前显示原文说明。

Use when you need to check whether an organisation/domain has been claimed by a ransomware group, profile a specific ransomware group (TTPs, leak-site infra, IOCs, YARA), or aggregate ransomware victim claims by country/sector/timeframe. Backed by ransomware.live's leak-site scrapes — 27k+ victims across 330+ groups. Commonly invoked by /domain-investigation, /ransomware-ecosystem, /threat-actor-profiling, and detection-engineering workflows. Reads $RANSOMWARE_LIVE.

中文简介正在准备中。当前显示原文说明。

Use the Malpedia platform and API to research malware family relationships, track variant evolution, link families to threat actors, and integrate YARA rules for detection across malware lineages.

中文简介正在准备中。当前显示原文说明。

Use the Malpedia platform and API to research malware family relationships, track variant evolution, link families to threat actors, and integrate YARA rules for detection across malware lineages.

中文简介正在准备中。当前显示原文说明。

Use the Malpedia platform and API to research malware family relationships, track variant evolution, link families to threat actors, and integrate YARA rules for detection across malware lineages.

中文简介正在准备中。当前显示原文说明。