m0n4 / yara-matches-correspondance-array

A tool designed to help writing and updating YARA rules.

YARA Matches Correspondance Array

YMCA is designed for threat hunters, incident responders, security analysts or anyone writing detection or hunting rules.
This tool focuses exclusively on the strings section of the rules.
It visually presents the correspondences between a ruleset and a collection of samples.

Usage

• Download and run the standalone binary (Linux / Windows)
• Head to localhost:4449

Use Case

• To have a complete view of the coverage of a new rule.
• To review the accuracy of an existing rule at the start of a new campaign.

Screenshot