Logo
Picture

Victor M. Alvarez @plusvic

Software Engineer at https://t.co/hCtkCkTR4I Joined June 2009
  • Tweets
    2K
  • Followers
    4K
  • Following
    200
  • Likes
    518
plusvic Profile Picture

Victor M. Alvarez @plusvic

2 weeks ago

@wessorh Yes, you submit a PR

plusvic Profile Picture

Victor M. Alvarez @plusvic

2 weeks ago

YARA-X 1.17.0 has been released. This time with the long-awaited `--fast-scan` option. github.com/VirusTotal/yar…

plusvic Profile Picture

Victor M. Alvarez @plusvic

2 weeks ago

@wessorh With this new repository I have the intention of creating a canonical benchmarking suite for YARA-X and YARA: github.com/VirusTotal/yar… I'll be adding more rules and files in the future. The idea is covering all those cases in which YARA and YARA-X tend to differ in performance.

plusvic Profile Picture

Victor M. Alvarez @plusvic

2 weeks ago

@wessorh Yep, much better if you use a corpus of real files, specially if rules are making use of modules like pe, elf, etc.

plusvic Profile Picture

Victor M. Alvarez @plusvic

2 weeks ago

@wessorh From the number of files, and their total size, I would say that the time is dominated by rule compilation/loading, and that would explain the bad results of YARA-X. For benchmarking scanning speed I would recommend bigger and more files, so that the scanning phase takes longer.

plusvic Profile Picture

Victor M. Alvarez @plusvic

2 weeks ago

@cyb3rops @wessorh I found this conversation with @regeciovad but it doesn't contain details. github.com/VirusTotal/yar…

plusvic Profile Picture

Victor M. Alvarez @plusvic

2 weeks ago

@cyb3rops @wessorh I was trying to recall the details about why I discarded the vectorscan/hyperscan option long ago, but I didn't write down my thoughts back then. I considered using hyperscan for YARA, but I found subtle differences that didn't make it a good fit for YARA's use case.

plusvic Profile Picture

Victor M. Alvarez @plusvic

4 weeks ago

For those who are interested in learning about the recent performance improvements in YARA-X: virustotal.github.io/yara-x/blog/ya…

plusvic Profile Picture

Victor M. Alvarez @plusvic

2 weeks ago

@wessorh I also would like to figure out why YARA-X seems to be consistenly slower than YARA C in your tests. My own tests point in the opposite direction after the improvements in YARA-X 1.16.0. But performance is very sensitive the the rules and files scanned.

plusvic Profile Picture

Victor M. Alvarez @plusvic

2 weeks ago

@wessorh Contributions are always welcomed. For instance, a canonical set of rules and files that can be used for benchmarking would be really great. So that different implementations can be compared using that canonical set.

plusvic Profile Picture

Victor M. Alvarez @plusvic

2 weeks ago

@wessorh @cyb3rops holloman2 is the interesting part because the claims are bold. If I understood correctly, you can enterily avoid the Aho-Corasick scan by comparing the file's fingerprint to the pattern's fingerprint. That would discard files that don't contain the pattern. Is that correct?

plusvic Profile Picture

Victor M. Alvarez @plusvic

2 weeks ago

@wessorh @cyb3rops Do you plan to open source yara-g in the future?

plusvic Profile Picture

Victor M. Alvarez @plusvic

3 weeks ago

@halvarflake I feel the same. For projects that I really care about my strategy consists in forcing myself to treat the AI like a pair-programming buddy. With that mindset I feel productive but in control, and actually end up learning a few things from the AI.

plusvic Profile Picture

Victor M. Alvarez @plusvic

4 weeks ago

@dev_metthal No, in such cases it won't help. You are probably thinking about cases in which the same function is called with multiple regexes, right?

plusvic Profile Picture

Victor M. Alvarez @plusvic

4 weeks ago

@cyb3rops @wessorh I guess there's a lot of variance too. Person A can create tons of bad rules within seconds, while person B takes the time to find a pattern that is likely to cover most specimens of a malware family while not producing false positives.

plusvic Profile Picture

Victor M. Alvarez @plusvic

4 weeks ago

@wessorh Hard to tell. I haven't seen any research in that topic. Maybe @cyb3rops has some relevant metrics, they create a lot of rules.

plusvic Profile Picture

Victor M. Alvarez @plusvic

a month ago

@wessorh That sounds very interesting. If you can point me out to some repository I would take a look. Also, I think it would be great to have a canonical set of rules and files for benchmarking. I can come up with something.

plusvic Profile Picture

Victor M. Alvarez @plusvic

a month ago

YARA-X 1.16.0 is out! This time with performance improvements that make it much faster. With this release YARA-X is faster than traditional YARA in almost every case. github.com/VirusTotal/yar…

plusvic Profile Picture

Victor M. Alvarez @plusvic

2 months ago

YARA-X 1.15.0 is out! github.com/VirusTotal/yar…

Trends for United States

Knicks
Spurs
Aaron Fox
Wemby
#NBAFinals
Mitch Johnson
OG Anunoby
Josh Hart
Taylor Swift
Harper
JR Smith
Falcons
Alvarado
Game 5
Castle
Mike Brown
Wu Tang
Down 29
Sacramento
Mike Breen

You might like

Managed Compromise Assessments #YARA #IOCs #DFIR #APT #Sigma - the home of @thor_scanner, ASGARD and the Aurora Agent
Nextron Systems
@nextronsystems
9K Followers
A curated, high-quality malware corpus. Zoo keepers: @push_pnx and @steffenenders_
Malpedia
@malpedia
6K Followers
Deep Malware and Phishing Analysis for Windows, Android, macOS and Linux.
Joe Security
@joe4security
8K Followers
Official account of the Volatility Memory Analysis Project and Windows Malware and Memory Forensics Training. https://t.co/A4TZ1FOjpg
volatility
@volatility
23K Followers
You may know me from your logs Principal Security Researcher @Censysio #Threats / #CTI / #Malware / #Hacking
Silas Cutler (p1nk)
@silascutler
14K Followers
Payloads or it didn't happen. https://t.co/rAVsWT6dcl
CAPE Sandbox
@CapeSandbox
5K Followers
Willi Ballenthin
@williballenthin
7K Followers
Cybersecurity researcher focused on threat intel & APTs. Breaking down attacks, hunting threats, and crafting YARA rules. Buddy @ Three Buddy Problem
Costin Raiu
@craiu
39K Followers
Author of oletools, olefile, ViperMonkey, ExeFilter, Balbuzard. #DFIR, #malware analysis, maldocs, file formats, #Python. @decalage@mastodon.social
Philippe Lagadec
@decalage2
5K Followers
Threat Intel as a reverse-engineer in Crimeware domain. Dubbed
sysopfb
@sysopfb
4K Followers
#threatintel and #dfir lead @ PwC. Blue team forever. Christian, husband, dad, coffee addict, bad photographer, awful cyclist. Tweets my own, not PwC's.
Kris McConkey
@smoothimpact
5K Followers
Malware Analyst @BoschGlobal CERT | Author of #pestudio
marc ochsenmeier
@ochsenmeier
14K Followers
Security Researcher at A Security
Tomer Zait
@realgam3
1K Followers
POP, NOP and ROP walk into a bar. Follow me on Mastodon: https://t.co/sKz7VC2unX
Vitaly Kamluk
@vkamluk
4K Followers
MSTIC RE @MsftSecIntel | Ex FLARE RE @Mandiant | @CuratedIntel
Chuong Dong
@cPeterr
5K Followers