Logo
Sophos AI YaraML Rules Repository

Sophos AI YaraML Rules Repository

#Security Testing#Malware Analysis

A simple framework for extracting actionable data from Android malware

Visit Website

YaraML is a tool that

YaraML is a tool that automatically generates Yara rules from training data by translating scikit-learn logistic regression and random forest binary classifiers into the Yara language. Give YaraML a directory of malware files and a directory of benign files of any format and it'll extract substring features, downselect your feature space, train a model, and then "compile" the model and return it as a textual Yara rule. To get a feel for what this looks like, see the logistic regression Powershell detector generated by YaraML and given below.