YARA is an open-source malware analytic tool. YARA rules help analysts identify and classify malware samples by creating groups of malware families based on byte-level rules to quickly analyze large quantities of files for matches. If the analysts identify a suspicious byte pattern, they can create a new YARA rule to identify likely malicious files. YARA integration results report whether an unknown file has been previously classified as malicious.
YARA rules are written and uploaded to IVX Cloud as ASCII text files. You can define YARA rules that are specific to a particular file type, or common rules that apply to all file types:
Base content: Allows IVX Cloud to apply the YARA rule to a particular file type or to all common file types. IVX Cloud does not extract the macro from the sample.
Active content: Allows IVX Cloud to apply the YARA rule to DOC, DOCX, PPT, PPSX, PPTX, XLS, XLSX, or common file types. IVX Cloud extracts the macro from the sample for analysis.
Base content and Active content: Allows the Malware Analysis appliance to apply the YARA rule to DOC, DOCX, PPT, PPSX, PPTX, XLS, XLSX, or common file types. IVX Cloud analyzes the sample and extracts the macro from the sample for analysis.
On the Settings > Yara Rules page, click Upload Yara File.
In the dialog, select the file you want to upload, the type of content, and the file type.
Click Save.