Skip to content

Conversation

@bamed
Copy link

@bamed bamed commented Nov 17, 2025

Proposed changes

  • if YARA_PROPAGATE_MALWARE_RELATIONSHIP = true, and a Yara indicator has a relationship to a Malware entity, then for each matching Artifact an Artifact is 'related-to' Malware Relationship is also created
    *if YARA_PROPAGATE_LABELS = true, and a Yara indicator has any lables, those labels are added to any matching Artifacts

Checklist

  • I consider the submitted work as finished
  • I have signed my commits using GPG key.
  • I tested the code for its functionality using different use cases
  • I added/update the relevant documentation (either on github or on notion)
  • Where necessary I refactored code to improve the overall quality

Further comments

The current Yara connector matches Yara indicators to Artifacts and then creates a 'related-to' relationship between the Indicator and Artifact. This only identifies which Yara signature matches a file, but since a Yara signature is an indicator of something else, to add real threat intel value, we need a way to identify what the Yara signature is indicating. This update helps by propagating relationships between malware and signatures to the matching artifact, or by propagating labels from the Yara indicator to the Artifact, thus taking the connector to the next step and actually using it to identify malware samples. I could see some extra value in propagating some other relationships, such as Techniques, but we'll save that for future updates.

…_PROPAGATE_MALWARE_RELATIONSHIP = true, and a Yara indicator has a relationship to a Malware entity, then for each matching Artifact an Artifact is 'related-to' Malware Relationship is also created 2) if YARA_PROPAGATE_LABELS = true, and a Yara indicator has any lables, those labels are added to any matching Artifacts
@romain-filigran romain-filigran added the community use to identify PR from community label Nov 18, 2025
@Ninoxe Ninoxe changed the title YARA - propagating Malware relationships and labels from Indicators to matching Artifacts [YARA] propagating Malware relationships and labels from Indicators to matching Artifacts Nov 21, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

community use to identify PR from community

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants