Detekční Pravidla pro Detekci Ransomware ve Formátech YARA a Sigma

This thesis focuses on analysis and defense against ransomware using detection rules. It provides an overview of the different types of ransomware and explores their lifecycle from infecting the system to extorting the victim. It also deals with methods of static and dynamic analysis of malicious software. In addition, it also examines the techniques that are used to defend against analysis. Subsequently, work with rules in YARA and Sigma formats is described. In the design part, rules are implemented in these formats aimed at general detection of ransomware samples.

This thesis focuses on analysis and defense against ransomware using detection rules. It provides an overview of the different types of ransomware and explores their lifecycle from infecting the system to extorting the victim. It also deals with methods of static and dynamic analysis of malicious software. In addition, it also examines the techniques that are used to defend against analysis. Subsequently, work with rules in YARA and Sigma formats is described. In the design part, rules are implemented in these formats aimed at general detection of ransomware samples.

Keywords

ransomware, detekce, yara, sigma, pravidla, malware vzorky, analýza malware, šifrování, ransomware, detection, yara, sigma, rules, malware samples, malware analysis, encryption

URI

http://hdl.handle.net/10467/114674

Collections

Master Theses - 18106

Full item page

Detection rules for Ransomware detection in YARA and Sigma formats