Anonymous YARA Rules Are Not Anonymous

Usman Rabiu Isah, Laurent Bobelin, Pascal Berthomé

YARA rules are widely shared across threat intelligence communities to enable collective defence against malware. This practice implicitly assumes that removing metadata (e.g., aut…