Introducing “YAYA”, a New Threat Hunting Tool From EFF Threat Lab

At the EFF Threat Lab we spend a lot of time hunting for malware that targets vulnerable populations, but we also spend time trying to classify malware samples that we have come across. One of the tools we use for this is YARA. YARA is described as “The Pattern Matching Swiss Knife for Malware Researchers.” Put simply, YARA is a program that lets you create descriptions of malware (YARA rules) and scan files or processes with them to see if they match. 

The community of malware researchers has amassed a great deal of useful YARA rules over the years, and we use many of them in our own malware research efforts. One such repository of YARA rules is the Awesome YARA guide, which contains links to dozens of high-quality YARA repositories. 

Managing a ton of YARA rules in different repositories, plus your own sets of rules, can be a headache, so we decided to create a tool to help us manage our YARA rules and run scans. Today we are presenting this open source tool free to the public: YAYA, or Yet Another YARA Automation. 

Introducing YAYA

YAYA is a new open source tool to help researchers manage multiple YARA rule repositories. YAYA starts by importing a set of high-quality YARA rules and then lets researchers add their own rules, disable specific rulesets, and run scans of files. YAYA only runs on Linux systems for now. The program is geared towards new and experienced malware researchers, or those who want to get into malware research. No previous YARA knowledge is required to be able to run YAYA.

A video example of YAYA being run

If you are interested in getting YAYA or contributing to its development, you can find the github repository here. We hope this tool will make a useful addition to many malware researchers’ tool kits.