Tips on Using Externals

The example of exernals in the video above is simple, but isn’t particularly useful in the real world as it requires one-by-one command line entry. A more practical implementation of externals could happen in scripts or other automations where you can define rules and programatically feed in external variables for data that cannot be natively leveraged in YARAs rules, opening up a world of detection possibilities.


Here is an example of using external variables and yara-python in a python script:


https://gist.github.com/tlansec/e4bcd7f65c21acddec848fca14cab978
