Custom YARA rules

[raqueltabuyo]

Value proposition
Enable Elastic Defend users to automatically detect known malware and suspicious patterns through automated YARA scans integrated with Elastic Defend, while also providing the flexibility to add and manage custom YARA rules directly from the Elastic Security UI. This enhances Elastic Defend’s threat detection depth and gives analysts more control over custom detection logic without relying on external tools.

Expected outcome

• Elastic Defend will automatically execute YARA scans.
• Analysts can create, import, and manage custom YARA rules within Elastic Security.
• Scan detections are promoted as detection alerts, enabling better investigation and correlation workflows in Security Investigations and Timeline.
• Improves detection coverage against commodity and advanced threats, and supports threat hunting use cases aligned with malware research workflows.

Key user stories / use cases

• As an analyst, I can define custom YARA rules within Elastic Security so I can detect specific malware families relevant to my environment.
• As an incident responder, I can view YARA detections directly from detections alerts, correlating detected matches with Elastic Defend telemetry for deeper analysis.
• As an administrator, I can centrally manage and distribute custom YARA rules across my organization through Elastic Agent policy configurations.