Yara Rules

Example:

rule foundUPX {
	meta:
		description = "Find files packed with UPX"

	strings:
		$checkUPX0 = "UPX0"
		$checkUPX1 = "UPX1"
		$checkUPX2 = "thug.lyfe" nocase

	condition:
		any of them
}

LOLBINS - Living off the Land Binaries

• Attackers will often use these because they are less likely to be detected/blocked, as they are native tools and domain admins can use them as well

ex. mshta - used to download help files for things like PuTTY, can be used to download other malicious files