Kaspersky Open Sources Internal Distributed YARA Scanner

itman · Mar 28, 2018

Kaspersky Lab has released the source code of an internally-developed distributed YARA scanner as a way of giving back to the infosec community.

Originally developed by VirusTotal software engineer Victor Alvarez, YARA is a tool that allows researchers to analyze and detect malware by creating rules that describe threats based on textual or binary patterns.

Kaspersky Lab has developed its own version of the YARA tool. Named KLara, the Python-based application relies on a distributed architecture to allow researchers to quickly scan large collections of malware samples.

Looking for potential threats in the wild requires a significant amount of resources, which can be provided by cloud systems. Using a distributed architecture, KLara allows researchers to efficiently scan one or more YARA rules over large data collections – Kaspersky says it can scan 10Tb of files in roughly 30 minutes.
Click to expand...

https://www.securityweek.com/kaspersky-open-sources-internal-distributed-yara-scanner

Minimalist · Mar 18, 2020

Hunting APTs with YARA

For the past few years, we have been spreading our knowledge and experience of using YARA, often called a pattern matching swiss knife for malware researchers (and everyone else). Most of the time, this took the form of the Kaspersky training course titled, “Hunting APTs with YARA Like a GReAT Ninja”. The first YARA training session of that kind took place in February 2016, on the beautiful islands of Tenerife. We have had hundreds of participants attend sessions in over a dozen countries since then.
Click to expand...

https://securelist.com/hunting-apts-with-yara/

Minimalist · Apr 6, 2020

YARA webinar follow up

If you read my previous blogpost Hunting APTs with YARA then you probably know about the webinar we conducted on March 31, 2020, showcasing some of our experience in developing and using YARA rules for malware hunting.
Click to expand...

https://securelist.com/yara-webinar-follow-up/

Minimalist · Sep 29, 2020

Why master YARA: from routine to extreme threat hunting cases. Follow-up

On 3rd of September, we were hosting our “Experts Talk. Why master YARA: from routine to extreme threat hunting cases“, in which several experts from our Global Research and Analysis Team and invited speakers shared their best practices on YARA usage. At the same time, we also presented our new online training covering some ninja secrets of using YARA to hunt for targeted attacks and APTs.
Click to expand...

https://securelist.com/why-master-yara/

Log in or Sign up

Kaspersky Open Sources Internal Distributed YARA Scanner

itman Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Log in or Sign up

Kaspersky Open Sources Internal Distributed YARA Scanner

itman Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Useful Searches