Reference no: EM133255476

1. Considering the pattern matching for regex2, why do you think the YARA program did not fire any alert?
2. What changes can you make to this regex in the YARA signature (cst630_rules-2.yara) or the target file (cyberattacks_file.txt) for a match to occur?
3. Using the GREP command with YARA signature search routines, what do you think accounts for these differences?
4. What popular open-source pattern-matching engine are you comfortable with? Describe a technique a malware attack uses to persist on a system.
5. Malware researchers and forensic experts preserve the integrity of the evidence being acquired from a suspect system while doing a forensic memory acquisition. What role does malware using YARA play in this effort?
6. What advantages does static analysis have over dynamic and vice-versa?
7. (Optional) Considering the pattern matching for the hex matching, why do you think the YARA program fired or did not fire any alert? What changes can you make to these hex strings in the YARA signature (cst_hex_rules.yara) or the target file (cst_hex.txt) for a match to occur? [Hint: Try other sets of conditions such as $hex1 and #hex2 or #hex3; all of them, etc. OR make changes to the hex file]