Write the rule

Malware analysts turn what they find into detection rules. Write one that flags every malicious sample and leaves the clean files alone. It's scored live as you type, using the same ideas as YARA.

Read the beginner’s guide to malware analysis

Practice for defenders. This lab trains the skills SOC analysts, incident responders and sysadmins use to protect systems. Everything runs in your browser. The companies, people, data and IP addresses are made up, and nothing here touches a real system. Only use security skills on systems you own or have written permission to test.

rule.yar

Rule syntax

strings:
  $a = "exact text"
  $b = "any case" nocase
  $c = /regex[0-9]+/i
condition:
  any of them
  all of them
  2 of them
  $a and ($b or not $c)