Test a rule before you trust it
A teammate wants to deploy a YARA rule fleet-wide. Run it against known-good software and known samples, measure false positives and misses, and see why one sample slips past.
Briefing
The candidate rule in ~/rules/candidate.yar looks for cmd.exe /c or powershell inside any executable. A tuned version adds the loader’s command-line flags and its mutex name.
/srv/goodware holds clean installers and admin tools from your software catalog. /srv/samples holds four confirmed loader samples from the incident. A rule worth deploying hits every sample and no goodware.
detect-lab · YARA triage
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.