โ ๏ธ QUARANTINED
๐ฌ Intermediate
๐ What You'll Learn Here
Managing a corpus of known-bad samples โ validation testing, false positive analysis, and test-driven rule development.
Learning Outline
- 1. Sample Collection โ VirusShare, MalwareBazaar, internal captures
- 2. Safe Handling โ Isolated environments, hashing, no execution
- 3. Test Corpus Management โ Known good vs known bad
- 4. Rule Validation โ `yara --test-rules` with test corpus
- 5. False Positive Analysis โ Identifying rules that hit benign files
- 6. Threshold Tuning โ Adjusting rules based on test results
- 7. Sample Labeling โ Tagging by family, behavior, packer
- 8. Automation โ Automated test runs after rule changes
๐ ๏ธ QUARANTINE MANAGEMENT (Coming Soon)
Upload, label, and organize malware samples for testing.
Upload, label, and organize malware samples for testing.
๐ Resources
- ๐ฆ VirusShare
- ๐ฆ MalwareBazaar
- ๐งช YARA Test Framework