topic Re: Transcribing Yara Signatures for PA Custom Threat Signatures in General Topics

Transcribing Yara Signatures for PA Custom Threat Signatures

apc050 — Tue, 11 Jan 2011 22:02:57 GMT

Hello All,

Has anyone translated, transcribed or converted an existing Yara malware signature to a Palo Alto custom threat signature?

http://code.google.com/p/yara-project/

Thanks,

-Paul

Re: Transcribing Yara Signatures for PA Custom Threat Signatures

gsamuels — Wed, 12 Jan 2011 02:50:08 GMT

Hi,

You would have to submit this description to support for conformation against our archives.

Regards,

Gary S.

Re: Transcribing Yara Signatures for PA Custom Threat Signatures

rbergen — Tue, 22 Oct 2013 19:40:30 GMT

Just curious what the outcome of this was? Has this been done? I am also interested in this too.

Re: Transcribing Yara Signatures for PA Custom Threat Signatures

HITSSEC — Wed, 23 Oct 2013 19:09:48 GMT

This is interesting and yet challenging as PaloAlto Custom Vulnerability signatures use Contexts so you would need to know where you should be looking for the strings defined in the Yara definitions. The conditional statements within Yara offer a lot of flexibility and that would be hard to do within PA. Simple definitions I believe are doable, providing you know where to look in the flow (context). We are currently creating custom signatures but I have not tried any yara signatures because I don't know in what context I need to look.

Phil