#100daysofyara I like taking the approach of having multiple YARA rules to detect the same thing from different perspectives, like these rules for Cronos Crypter. One looks for just strings, another a string + encryption salt, 3rd for assembly name
Tony Lambert
@forensicitguy.bsky.social
421 followers 245 following 5 posts
Recovering sysadmin that now chases adversaries instead of uptime. Sr Malware Analyst @redcanary