To use the memory dump rule, you must first create a custom memory dump rule based on the memory dump logs.
In a text file, write the first rule and give it a name that will appear in the Analysis Report.
Enter the comments in the text file to track the memory dump logs or data that are the source of your custom memory dump rules.
Enter the metadata for the rule.
Metadata is mandatory for standard rules and optional for helper rules. Metadata includes classification, description, and severity information for custom memory dump rules. Use a [metadata field name] = [string/value] format to define these three metadata fields.
Enter the classification value for custom memory dump rules.
Enter the description for the rule, which is displayed in the analysis reports.
Enter a severity value. A severity value must be an integer from 1-5, with 5 indicating the most malicious behavior. These severity values are irrelevant for helper rules.
When two rules are applied, only the rule with the highest severity is executed first. When both rules have the same severity, the rule that is applied first will be executed.
Log on the Intelligent Sandbox web interface.
Click → , click
, then select Memory Dump Logs.On the text editor, enter the strings and conditions according to YARA syntax.
Add more rules according to your requirement in the same custom YARA text file, then save the file.