Endpoint Protection

I've just stumbled across these things called Yara rules. The way I understand it, they are rules that allow us to scan files and then identify the type of malware or if infact they are malware and then suggest classification. I see that Symantec already uses them. 

So are they for identifying zero day exploits that Symantec has not yet released signatures for? If so, where would I enter Yara rules i get from a security bulletin? 

Or am I completely wrong about what they are?

Where did you see that for SEP? SEP custom IPS signatures use the SNORT syntax. YARA is just a tool to search for IOCs on a machine, but, it doesn't integrate with SEP in any way.

Thanks Brian! Always one of the first to respond. 

Towards the bottom: https://plusvic.github.io/yara/ (Who's using YARA)

We were sent a security bulletin with several CVE's and Yara rules from a security audit firm. Their bullentin says to use Yara rules for network defense. I figured I could punch those in to Symantec somewhere but guess not.

Never heard of such thing beings used in SEP

Nope, unfortunately not.

YARA is a standalone tool and doesn't integrate with SEP. Great tool though.

So you install a Yara editor on a PC and create rules and then run the rules again a file to see if its infected?

can i use symantec to block these files and how?

Filename MD5 Notes:
m64.exe
3517b5d972955f86e02c5abe2a1693bd
64-bit version of Mimikatz
mimi_morph.exe

afa6d09443ed9414e7ac395b77ec3144
32-bit version of Mimikatz
wu.ps1
59cdaabe07f5ae504cc83def99fd7fe3
PowerShell script to push out Mimikatz

LogonUI.exe
7170ea924e749b4c9e26120ba5e72264
Python executable backdoor

LogonUI.exe
cc11b319bd53208649eb699045bd5053
Unpacked executable

Yes, you can use an application control policy to block the hashes

Yea, you can download a windows version as well:

https://plusvic.github.io/yara/

I'd start with the documentation, it's pretty solid.

Hey Brian, I created an application policy and blocked the md5 hashes in it and assigned it to a group. How can check on an individual client if that application policy has been update to the PC?

On your SEP client go to Help >> Troubleshooting and under General Information will be the Policy Serial Number.

You'll to compare that with the one in the SEPM to ensure they match.