BSidesLV 2017

YARA is a simple and highly effective way to identify, classify, and categorize files. It also happens to be a powerful and free sleuthing tool - think pattern matching on steroids - that belongs in every intelligence, incident response or SOC team. It runs on any platform, is open source and is small enough to be an easy inclusion to any trusted tool set. Its ability to sift through data, identify files based on logic - not just by simple comparison but also via fuzzy logic - makes YARA pretty unbeatable. It can used simply for insight on an isolated event or in sophisticated manner as part of an incident response or research laboratory. Those not using YARA are missing out on key intelligence capability. Its ease of use and ability to rapidly deploy means you can get into YARA quickly but can just as easily lead to missing the sophisticated and powerful ways to use it.