Transcribing Yara Signatures for PA Custom Threat Signatures

[apc050]

Hello All,

Has anyone translated, transcribed or converted an existing Yara malware signature to a Palo Alto custom threat signature?

http://code.google.com/p/yara-project/

Thanks,

-Paul

[gsamuels · Accepted solution]

Hi,

You would have to submit this description to support for conformation against our archives.

Regards,

Gary S.

[rbergen]

Just curious what the outcome of this was? Has this been done? I am also interested in this too.

[HITSSEC]

This is interesting and yet challenging as PaloAlto Custom Vulnerability signatures use Contexts so you would need to know where you should be looking for the strings defined in the Yara definitions.  The conditional statements within Yara offer a lot of flexibility and that would be hard to do within PA.  Simple definitions I believe are doable, providing you know where to look in the flow (context).  We are currently creating custom signatures but I have not tried any yara signatures because I don't know in what context I need to look.

Phil