0

Im looking to test a set of YARA rules against a corpus of 'goodware'. Virustotal's own blog [2] suggests use of the National Software Reference Library [1] however the NRSL RDS(Data Sets) have instances of Malware and Stenography Hashes which aren't useful for my purposes.

My interest is to test my rules against said 'goodware' to understand false positives and other rule behavior. Does anyone know if there is a subset of NRSL libraries that can be used for this purpose or any other equally credible sources, void of any malware hashes?

6
  • 1
    And the home page doesn't answer you? "The RDS is a collection of digital signatures of known, traceable software applications. There are application hash values in the hash set which may be considered malicious, i.e. steganography tools and hacking scripts. "
    – schroeder
    Nov 17, 2021 at 16:14
  • Virus total recommends using their corpus to test for false positive rules on Yara runs. Im wondering if there are specific corpus that are entirely 'goodware' for the sake of these tests. The site doesn't seem to make explicit reference to particular data sets that may be entirely clean for the purposes of checking. Virustotal seems to have their own corpus from NSRL incorporated into their LiveHunt module. Just wondering if anyone has worked with NSRL or NIST corpuses and can guide me for this use case
    – N S
    Nov 17, 2021 at 16:18
  • Then that's a different question than what you asked.
    – schroeder
    Nov 17, 2021 at 16:20
  • Ill edit my question then thanks schroeder
    – N S
    Nov 17, 2021 at 16:20
  • NSRL contains Hashes. I presume your YARA rules need to be run against actual software, not hashes. It's not clear to me your intent here? Shouldn't you run your YARA rules against a known good computer system or several? Nov 17, 2021 at 17:29

0

You must log in to answer this question.

Browse other questions tagged .