About YARA scan in Kaspersky Endpoint Agent

A YARA scan is a process performed by Kaspersky Endpoint Agent to search for malicious activity signatures on devices using YARA files (signature files of the open YARA standard). The scan is performed recursively on local drives. The scan is not supported for network, connected and cloud resources.

YARA files are the files with the yara or yar extension that contain YARA rules.

YARA rules are the descriptions of signatures for targeted attacks and intrusions into the organization's IT infrastructure. Kaspersky Endpoint Agent scans the objects according to these rules. If the rule is executed, the analyzer issues an infection verdict with the corresponding details in the log.

Kaspersky Endpoint Agent supports the following types of YARA scans:

• YARA files scan using the command line – group or local tasks that are created and configured using the command line interface. YARA files prepared by the user are used to run the scan.
• YARA scan by files downloaded manually via the Kaspersky Anti Targeted Attack Platform web interface – allows application users to use YARA files to search for signs of targeted attacks, infected (or probably infected) objects in the event and detection database, and to scan computers on which Kaspersky Endpoint Agent is installed.

The scan types differ by the management capabilities and configurable settings. The YARA scan types are described in the following table.

YARA scan types