Module 10: YARA — Malware Detection & Hunting
Write rules that find malware. Hunt across files, endpoints, and memory.
6 lessons · 6 labs
YARAVelociraptorCyberChef
Operation APT Breach
Write YARA rules for malware dropped during Operation APT Breach.
Path
- Lesson01
YARA Fundamentals
Meta, strings, condition
- Lab02Intermediate
Lab 10.1 — Your First YARA Rule
Detect a malicious script. Zero FPs.
- Lesson03
String Patterns & Matching
Wildcards, hex, case-insensitive
- Lab04Intermediate
Lab 10.2 — Hex Pattern Hunting
Decode hex C2, write YARA rule.
- Lesson05
Conditions & Logic
Boolean operators, file size
- Lab06Advanced
Lab 10.3 — Webshell Detection
Find 5 webshells in 500 files.
- Lesson07
Hunting with YARA
Scanning files and directories
- Lab08Advanced
Lab 10.4 — Ransomware Indicator Rule
Analyze ransomware, write YARA rule.
- Lesson09
YARA + Velociraptor
Hunt across endpoints at scale
- Lab10Expert
Lab 10.5 — Endpoint-Wide Hunt
YARA in Velociraptor across all hosts.
- Lesson11
Real-World YARA Rules
523+ community rules analysis
- Lab12Intermediate
Lab 10.6 — Community Rules
Pick 3 rules. Explain and test.