Tools · Forensics tools · 13 / 25
YARA: scan the files the case already holds
Run the rule against the export folder, print the strings that fired, and triage each hit. The command is the easy part. The case log is the result.
Build a folder that matches the authorization
Make a directory that contains only this case’s extracts: the tagged Autopsy files, the Volatility text, the Sysmon CSV, and later the CyberChef output. Name it with the case number. Scan that directory. Recursive mode is appropriate inside it and inappropriate one level higher, where other cases live. If you mount the full disk image, be deliberate about excluding the examiner’s own tools directory, or scan from a mount that is only the evidence volume.
Hash the folder’s manifest or at least list the filenames you scanned. A hit list without the input list cannot be interpreted later, because someone will ask whether the Documents workbook was in the set. The Autopsy manifest already has those hashes. Point the YARA log at it.
Print the strings, and keep the versions
The useful invocation names the rule file, prints matching strings, and recurses through the case directory. Printing strings is how you see that $temp fired on a CSV cell and not on a binary. Count mode is a summary when you are tuning and do not want every offset yet. Save stdout to a text file named with the rule version. NL-2026-041-yar-v2.txt next to NL-2026-041-staged-name.yar is a pair. One without the other is incomplete.
If a scan errors on a path, read the error. A locked file or a path that is too long is an input problem, and the file was not scanned. Note it. A rule that fails to compile is a syntax problem, and nothing was scanned. Fix the rule, bump the version, and run again. Do not append a successful output under a failed header and hope the reader notices.
yara -r -s NL-2026-041-staged-name.yar NL-2026-041-exports > NL-2026-041-yar-v2.txt
Label every hit in one pass
Open the output once and label each path. Use a short set of labels: content, mention, expected-test, needs-review. Content means the file is the artifact, such as a script that contains the path. Mention means a log or a report quoted the path. Expected-test is your positive sample. needs-review is anything you cannot place in those three in under a minute. The labels go in the case log. They are the triage.
A second rule file can separate “mentions we wrote ourselves” from “files from the image,” but only if you are careful not to hide a real hit inside a file you authored. The timeline CSV is yours and it mentions the path. That hit is legitimate and uninteresting. A hit inside pagefile.sys from the image is interesting and may be a fragment. The label is what keeps those two from looking identical in a count of “seven matches.”
Hand the rule over without the rest of the disk
The SOC may want the rule on a sensor. Give them the yar file and the test list: must hit, must not hit. Tell them the size cap and the strings in a sentence so they can judge noise. You do not give them the payroll workbook so they can “try it.” The hashes and the synthetic test files are enough. A rule tuned on a secret document should be checked once more to be sure it is matching the staging pattern and not a unique sentence from the spreadsheet’s cells. If it matches cell text, it is a content rule for a confidential file, and it does not belong on a broad sensor.
Record where the rule is allowed to run. “Case export folder, version 2, 15 April” is the scope you actually used. Anything wider is a new request.
Worked case: four files, two labels
The export folder has the two workbooks, powershell.exe, the timeline CSV, and a UTF-16LE copy of the command line saved as cmdline-4812.txt. Version 2 hits the CSV and cmdline-4812.txt, prints both strings, and stays quiet on the workbooks and on powershell.exe. You label the CSV as mention and the command-line file as content.
The log line is: “v2, five files, two hits, labels recorded, no scan errors.” You attach the txt output to the case. The workbook hashes remain the Autopsy exhibits. YARA did not replace them. It found where the staged name is written down.
Diagram
From a case folder to a labeled hit list
- Folder
Only this case’s extracts. The manifest says what was in the set.
- Scan
Recurse, print strings, and save stdout under the rule version.
- Label
Mark each hit as content, mention, expected-test, or needs-review.
- Scope
Write where the rule ran. A wider deployment is a separate request, with the must-hit and must-not-hit files.
v2 scanned NL-2026-041-exports hits: timeline.csv (mention), cmdline-4812.txt (content) quiet: both workbooks, powershell.exe
Check yourself
1. The scan prints seven hits. One is your timeline CSV, one is the command-line extract, and five are other case notes you wrote that quote the path. What is the right description of the count?