Anonymous YARA Rules Are Not Anonymous

• URL: http://arxiv.org/abs/2605.26791v1
• Date: Tue, 26 May 2026 10:01:50 GMT
• Title: Anonymous YARA Rules Are Not Anonymous
• Abstract summary: YARA rules are widely shared across threat intelligence communities to enable collective defence against malware.<n>To assess the validity of this assumption, we evaluate how much can be inferred from YARA rule text alone.
• Score: 0.0
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: YARA rules are widely shared across threat intelligence communities to enable collective defence against malware. This practice implicitly assumes that removing metadata (e.g., author fields) sufficiently protects the identity of contributing organisations. To assess the validity of this assumption, we systematically evaluate how much can be inferred from YARA rule text alone. Specifically, using a corpus of 23,305 rules from three major public repositories, we train independent classifiers along four stylometric fingerprint dimensions: individual author, source repository, malware family, and temporal drift, using three complementary methods: lexical n-grams (Burrows' Delta), syntactic AST features (Caliskan-Islam), and fine-tuned CodeBERT. Our results demonstrate that repository origin is almost perfectly recoverable (up to 99% accuracy), individual authors can be re-identified well above chance (76%), and malware family classification reaches 95%. Comparing the same repository attribution task across full-history and time-restricted subsets reveals a 9-18% accuracy gap, providing preliminary evidence of temporal drift in repository fingerprints.To further disentangle content from style, we conduct per-malware family author attribution experiments. Even when the malware family is the same for all samples considered, authors can still be re-identified for five of seven tested families (mean accuracy 74.6%). These findings constitute the first systematic demonstration that YARA rule sharing is a measurable OPSEC attack surface, and that metadata removal alone does not mitigate it.

Related papers

• MaliciousSkillBench: A Comprehensive Benchmark for Malicious Agent Skill Detection [24.37473229751569]
  MaliciousSkillBench is a comprehensive benchmark for malicious Agent Skill detection.<n>We consolidate 13 public sources, 11 of which contribute Core malicious artifacts, and reduce 8,414 raw malicious records to 7,539 normalized-unique identities.<n>We then evaluate three learned text detectors and three off-the-shelf Skill scanners.
  arXiv  Detail & Related papers  (2026-08-20T11:13:00Z)
• Reconcile Once, Write Anytime: A Trust-Tiered Librarian and a Multi-Agent Writer for Drift-Free, Point-in-Time Research [7.426963307811556]
  We present a two-tier agentic system that separates a maintained, point-in-time knowledge library from report writing.<n>A portable multi-agent "writer" runtime composes a contradiction-free, evidence-grounded report at any knowledge cutoff T.<n>We evaluate on a self-collected, public corpus of 6,130 sources yielding 555,926 evidence cards.
  arXiv  Detail & Related papers  (2026-08-13T09:09:28Z)
• Now You (Still) See Me: Detecting Evasive Steganographic Payloads in LLMs [52.149036302760386]
  Large language models can be fine-tuned to encode prompt-borne secrets into fluent, seemingly benign outputs.<n>Recent work proposes detection using linear probes that recover the secret from internal activations.<n>We show that this defense can be systematically evaded, but that detectability can be recovered through a targeted data-level intervention.
  arXiv  Detail & Related papers  (2026-06-08T12:27:11Z)
• ClawHub Security Signals: When VirusTotal, Static Analysis, and SkillSpector Disagree [0.4464102544889847]
  ClawHub Security Signals is a sanitized dataset of 67,453 latest public OpenClaw skill versions.<n>Each row pairs SKILL.md content and sanitized bundled files where present with a final ClawScan registry verdict and evidence from three scanner families.<n>Rather than estimating malicious-skill prevalence, we study scanner disagreement.<n>These results show that agent-skill security requires layered governance, not single-scanner allow/block decisions.
  arXiv  Detail & Related papers  (2026-05-31T23:20:25Z)
• Architecture Matters: Comparing RAG Systems under Knowledge Base Poisoning [0.0]
  RAG systems are vulnerable to knowledge base poisoning, yet existing attacks have been evaluated almost exclusively against vanilla retrieve-then-generate pipelines.<n>We evaluate four RAG architectures (vanilla RAG, agentic RAG, MADAM-RAG, and Recursive Language Models) under controlled single-document poisoning on 921 Natural Questions QA pairs.
  arXiv  Detail & Related papers  (2026-05-07T03:36:14Z)
• TwinGate: Stateful Defense against Decompositional Jailbreaks in Untraceable Traffic via Asymmetric Contrastive Learning [60.68349524623048]
  Decompositional jailbreaks pose a critical threat to large language models.<n>We present TwinGate, a stateful dual-encoder defense framework.<n>We construct a comprehensive dataset of over 3.62 million instructions spanning 8,600 distinct malicious intents.
  arXiv  Detail & Related papers  (2026-04-30T13:44:01Z)
• The Last Human-Written Paper: Agent-Native Research Artifacts [106.47848184955576]
  We introduce the Agent-Native Research Artifact (ARA), a protocol that replaces the narrative paper with a machine-executable research package.<n>Three mechanisms support the ecosystem: a Live Research Manager that captures decisions and dead ends during ordinary development; an ARA Compiler that translates legacy PDFs and repos into ARAs; and an ARA-native review system that automates objective checks so human reviewers can focus on significance, novelty, and taste.
  arXiv  Detail & Related papers  (2026-04-27T16:23:09Z)
• Making MLLMs Blind: Adversarial Smuggling Attacks in MLLM Content Moderation [54.38271718421492]
  Adversarial smuggling attacks exploit the Human-AI capability gap.<n>It encodes harmful content into human-readable visual formats that remain AI-unreadable.<n>We conduct a preliminary exploration of mitigation strategies.
  arXiv  Detail & Related papers  (2026-04-08T11:13:16Z)
• Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw [87.97230960702274]
  We present the first real-world safety evaluation of OpenClaw.<n>We introduce the CIK taxonomy, which unifies an agent's persistent state into three dimensions.<n>Our evaluations cover 12 attack scenarios on a live OpenClaw instance.
  arXiv  Detail & Related papers  (2026-04-06T15:27:05Z)
• Mapping the Exploitation Surface: A 10,000-Trial Taxonomy of What Makes LLM Agents Exploit Vulnerabilities [0.0]
  LLM agents with tool access can exploit security vulnerabilities.<n>What is not known is which features of a system prompt trigger this behaviour, and which do not.<n>We present a systematic taxonomy based on 10,000 trials across seven models, 37 prompt conditions, and 12 hypothesized attack dimensions.
  arXiv  Detail & Related papers  (2026-04-06T09:44:34Z)
• Can Adversarial Code Comments Fool AI Security Reviewers -- Large-Scale Empirical Study of Comment-Based Attacks and Defenses Against LLM Code Analysis [0.0]
  Adversarial comments produce small, statistically non-significant effects on detection accuracy.<n>Complex adversarial strategies offer no advantage over simple manipulative comments.<n>Comment stripping reduces detection for weaker models by removing helpful context.
  arXiv  Detail & Related papers  (2026-02-18T00:34:17Z)
• Detecting Corpus-Level Knowledge Inconsistencies in Wikipedia with Large Language Models [11.16952630564181]
  We focus on inconsistencies, a specific type of factual inaccuracy, and introduce the task of corpus-level inconsistency detection.<n>We present CLAIRE, an agentic system that combines LLM reasoning with retrieval to surface potentially inconsistent claims along with contextual evidence for human review.<n>In a user study with experienced Wikipedia editors, 87.5% reported higher confidence when using CLAIRE, and participants identified 64.7% more inconsistencies in the same amount of time.
  arXiv  Detail & Related papers  (2025-09-27T10:32:41Z)
• SHIELD: Thwarting Code Authorship Attribution [11.311401613087742]
  Authorship attribution has become increasingly accurate, posing a serious privacy risk for programmers who wish to remain anonymous. We introduce SHIELD to examine the robustness of different code authorship attribution approaches against adversarial code examples.
  arXiv  Detail & Related papers  (2023-04-26T02:55:28Z)
• Defending against Reconstruction Attacks with R\'enyi Differential Privacy [72.1188520352079]
  Reconstruction attacks allow an adversary to regenerate data samples of the training set using access to only a trained model. Differential privacy is a known solution to such attacks, but is often used with a relatively large privacy budget. We show that, for a same mechanism, we can derive privacy guarantees for reconstruction attacks that are better than the traditional ones from the literature.
  arXiv  Detail & Related papers  (2022-02-15T18:09:30Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.