Yara Modules

7.1. Integrating With Other Libraries Frameworks such as the Cuckoo Sandbox or Python's PE Module allows you to improve the technicality of your Yara rules ten-fold. 7.2. CuckooCuckoo Sandbox is an automated malware analysis environment. This module allows you to generate Yara rules based upon the behaviours discovered from Cuckoo Sandbox. As this environment executes malware, you can create rules on specific behaviours such as runtime strings and the likes. 7.3. Python PEPython's PE module allows you to create Yara rules from the various sections and elements of the Windows Portable Executable (PE) structure. Explaining this structure is out of scope as it is covered in my malware introductory room. However, this structure is the standard formatting of all executables and DLL files on windows. Including the programming libraries that are used. Examining a PE file's contents is an essential technique in malware analysis; this is because behaviours such as cryptography or worming can be largely identified without reverse engineering or execution of the sample.