YARA rules on Intelligent Virtual Execution - Server appliances

YARA is an open-source malware analytic tool that the IVX appliances support. YARA rules help analysts identify and classify malware samples by creating groups of malware families based on byte-level rules to quickly analyze large quantities of files for matches. If the analysts identify a suspicious byte pattern, they can create a new YARA rule to identify likely malicious files. YARA integration results report whether an unknown file has been previously classified as malicious.

YARA rules are written and uploaded to the appliance as ASCII text files. The use of YARA rules is enabled by default.

Note

For information about the supported YARA version for your release, see the Release Notes.

IVX appliances identify the file type of a suspicious sample file and then apply YARA rules to a collection of files in the following order:

You can create your own YARA rules or use the rules that Trellix provides. By default, every custom YARA rule has an integer weight associated with it, ranging from 0 to 100. During static analysis, when a YARA rule match is made, the weight of the matched rule is added to the overall score of the file deemed malicious. As more YARA rules are matched, the rule with the highest weight is used. If no weight is provided for a YARA rule, the default YARA weight is used.

Email alerts are generated when the YARA rule match weight reaches 100. You can also set riskware policy rules to generate riskware alerts when weights are between 0 and 99.