Brian Bell - Detection of malicious capabilities using YARA
Analysts investigate attack surfaces and defenses concerning Brian Bell - Detection of malicious capabilities using YARA.
Summary
Overview: hi folks AR here unfortunately the microphone was not turned on so we have no audio until about the 8 Minute 35 second Mark sorry for the inconvenience e e e e e e e e e e e e e for e e okay okay fair enough who was the last speaker cuz I think maybe they have the microphone he took it off but I know how many microphones you got on you two or one one all right continue at least look recording ambient fair enough I'm going to look around for that microphone it's got to be found so as I was saying
Key Topics: we can calculate Shannon entropy as a pretty reliable heris for detecting packed or encrypted executables even if they don't fire against a peid or Y signature uh in that case we've gone another layer into being able to detect malicious capability so if we find something that's ped or encrypted
Related talks
Briefings·25 min
Xiaochen Wang · Yiping Liu · Xiaoman Wang · Cong Cheng
Malware on the cloud is growing massively every day, and an automated rule generation solution is needed to improve operational efficiency.
Black Hat·27 min
Mathy Vanhoef
Industry experts analyze emerging threats surrounding Generating YARA Rules by Classifying Malicious Byte Sequences.
Black Hat·20 min
Security researchers examine technical aspects of Detecting Malicious Files with YARA Rules as They Traverse the Network.