The Detection Rules section in SMAP allows users to search, create, run, and export YARA rules, as well as view related analysis reports. It provides a central location for managing YARA rules and reviewing their results.
Key Capabilities
The YARA feature enables org analysts and org admin to create, manage, and apply detection rules during file analysis. Org analysts or org admin can create custom YARA rules by manually adding, uploading, or editing rule definitions. In addition, users can access the Seqrite’s internal YARA rule repository to leverage standardized detection rules.
All configured YARA rules are automatically applied to new preliminary file analyses, ensuring consistent rule execution across analyzed files.
Users can manage rule availability through Active and Inactive status controls. By default, a maximum of 10 user-created rules can be active at the same time. Permissions for creating, editing, and viewing rules are based on the user’s role and license.
Each detection entry includes the Rule Name, Confidence Level (High, Medium, or Low), Category, and Tags. YARA detection results are also included in the generated HTML analysis report, providing visibility into all matching rule detections.
Viewing Detection Rule Details
To view detection rules, follow these steps:
- On the Seqrite Malware Analysis Platform, select Detection Rules.
- To view the details of a particular YARA detection rule, select the rule and click icon.
On the Detection Rule page, under Custom Rule tab, you will see a list of custom YARA detection rules with details such as, Rule Name, Confidence (Low, Medium, High), Malware Category, Malware Family, Tags, Created By, and Status (Active/Inactive).
The View Details page displays the details, Rule Name, Description, Confidence level, Classification, Status, Category, Malware Family, Specify Family, Tags, and Rule Definition. You can also view the files to which the rule applies.
Filtering Detection Rule List
You can filter the detection rule list based on Confidence, Malware Category and Malware Family.
To filter the detection rule list, follow these steps:
- On the Seqrite Malware Analysis Platform, select Detection Rules.
- Click the
icon. - Select filters and click Apply.
Creating a Rule
To create a rule, follow these steps:
- On the Seqrite Malware Analysis Platform, select Detection Rules.
- Click Create Rule.
- To activate the rule, switch the toggle to Active.
- Enter rule details and rule definition and click Create Rule.
Note: The Rule Name must exactly match the rule name specified in the Rule Definition.
Exporting Detection Rule
- To export detection rule, select the rule you want to export and click
icon. - Click Export and the rule gets exported in. YARA format.
Duplicating Detection Rule
- To duplicate the existing YARA detection rule, select the rule you want to duplicate and click icon.
- Click Duplicate Rule.
- Click Duplicate Rule.
The Rule Details page appears. You can edit rule details.
Deleting Detection Rule
- To delete a detection rule, select the rule you want to delete and click icon.
- Click Delete Rule.
The rule gets deleted.
Note: A detection rule cannot be deleted if it is associated with one or more detections.
Activating/Deactivating Detection Rule
You can activate or deactivate a rule at any time after it is created. Set rules to Active if they should be included in the deployment and set them to Inactive if they should be excluded.
To activate/deactivate a rule, follow these steps:
- Select the rule and click icon.
- Turn the Status toggle On to activate the rule or Off to deactivate it.
Note:
- Active rules are included in the YARA bundle when deployment is triggered.
- Inactive rules are not included in the YARA bundle and do not participate in deployment.
Triggering Deployment
On clicking Trigger Deployment, all currently active YARA rules are selected automatically for YARA bundle creation. You do not need to select individual rules during deployment.
Once the YARA bundle is successfully generated and deployed, it becomes available as a scan engine in the back end. The deployed rules are then used to analyze uploaded files.
If an uploaded file matches the conditions defined in any deployed rule, the file is marked as Detected and the matching rule contributes to the detection verdict.
After a YARA detection rule is created, you can deploy the rule and make it available for detection. Rule deployment adds the selected YARA detection rules to a YARA bundle. Once deployed, the rules are used to analyze uploaded files. If an uploaded file matches the conditions defined in a deployed rule, the rule generates detection.
Note: Only admin can deploy YARA detection rules.
To trigger the deployment, follow these steps:
- On the Seqrite Malware Analysis Platform, select Detection Rules.
- Click Trigger Deployment.
All active YARA rules are included in the YARA bundle creation process. After the bundle is generated and deployed, it is available as a scan engine for file analysis.
Viewing Deployment History
On the Detection Rule page, under the Deployment History tab, you can view a list of all deployed bundles.