YARA

Hands On Training

Thursday — March 29th, 2012 13:30

YARA is more than just a malware classifier. Students will learn major elements of YARA's rule description language. In four hands-on labs participants will write their own rules and develop patterns to identify and classify obfuscation techniques as well as hash functions and encryption algorithms.

An Ubuntu-based training environment will be provided. Participants are expected to provide their own laptop, with at least 1 GB RAM free for applications, 10 GB free disk space, and the latest version of VMware (either Workstation, Player, or Fusion) installed. The virtual machine image will be available for download from http://r.forens.is/saopaulo starting March 27, 2012.

Presenters

• Andreas Schuster (Deutsche Telekom AG, DE)