Day 13: YARA!


YARA is a tool to collect digital footprints, like in physical world where forensic people use tools to collect fingerprints.

We define the rules about what a malicious behavior should be.

A rule file consists of several parts: meta, strings, condition. meta is for the author, in case there are 100s of files to maintain. strings...