Dec. 27, 2023, 9:23 a.m. | /u/Consistent-Music-471

For [Blue|Purple] Teams in Cyber Defence www.reddit.com

Hi all,

I want to hear about your solutions for querying YARA search at scale (1000+ endpoints, many rules at a time, scheduled)

Things I’ve tried:
- Creating a script through our EDR to scan a small set of rules (works slowly, limited to 50 endpoints, ran manually)
- Same process with Powershell Remoteing

Any other suggestions? Maybe there’s an endpoint agent that offers that?

Thank you!

blueteamsec edr endpoints powershell process rules scale scan script search solutions things yara yara rule

Financial Crimes Compliance - Senior - Consulting - Location Open

@ EY | New York City, US, 10001-8604

Software Engineer - Cloud Security

@ Neo4j | Malmö

Security Consultant

@ LRQA | Singapore, Singapore, SG, 119963

Identity Governance Consultant

@ Allianz | Sydney, NSW, AU, 2000

Educator, Cybersecurity

@ Brain Station | Toronto

Principal Security Engineer

@ Hippocratic AI | Palo Alto