Awesome
YARA Matches Correspondance Array
YMCA is designed for threat hunters, incident responders, security analysts or anyone writing detection or hunting rules.
This tool focuses exclusively on the strings section of the rules.
It visually presents the correspondences between a ruleset and a collection of samples.
Usage
- Download and run the standalone binary (Linux / Windows)
- Head to localhost:4449
Use Case
- To have a complete view of the coverage of a new rule.
- To review the accuracy of an existing rule at the start of a new campaign.
Screenshot
