False Positives

False positives break trust — test YARA on benign corpus in $MAL_LAB before proposing SOC deployment.

False Positives• Audio Walkthrough

00:00/03:10

Visual · mal_false_positives

YARA false positive literacy. $MAL_LAB only. Original Cyberlium.

A rule that fires on Windows system files is worse than no rule — FP hygiene is professional duty.

False positives occur when YARA matches benign files — shared strings in installers, game anti-cheat, or dev tools. Analysts maintain benign corpus (OS files, gold images, common apps) and test every new rule on $MAL_LAB before handoff to detection engineering. Cyberlium teaches FP review as part of YARA literacy — not 'trigger everything' hunting on unauthorized endpoints. Next: YARA Lab.

1. Sources of false positives

Overly short strings, common API names, generic error messages, and loose conditions. Packed benignware may share byte runs with malware — combine conditions (string + filesize + magic).

Document each FP found during $MAL_LAB testing and how condition was tightened.

Command guide

Try these commands — Sources of false positives

═══ LINUX / macOS (Malware Static & Dynamic Triage) ═══

Inspect PE / ELF binary headers and sections

Command — copy this

readelf -h sample.bin 2>/dev/null || xxd -g 1 -l 32 sample.bin

Check binary entropy (high entropy often signals packed or encrypted payloads)

Command — copy this

python3 -c "
import math, sys
data = open('sample.bin', 'rb').read() if len(sys.argv) > 1 else b'MZX\x00\x90'
ent = -sum((data.count(bytes([b]))/len(data))*math.log2(data.count(bytes([b]))/len(data)) for b in set(data))
print(f'Calculated File Entropy: {ent:.4f} (Entropy > 7.0 suggests packed/encrypted)')
" sample.bin 2>/dev/null

Primary tools to practice this lesson: yara, python3. Reference sites: YARA Python module (https://yara.readthedocs.io/en/stable/yarapython.html); MalwareBazaar YARA (https://bazaar.abuse.ch/export/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Benign corpus testing

Scan gold image files, common installers, and org-approved software on $MAL_LAB before production. Record match count: malware set N/N, benign set 0/N target.

Detection engineering may require FP rate threshold before merge to production repo.

3. FP handling in operations

SOC tunes exceptions, adds hash allowlists, or refines rule — never disable logging globally because one bad rule. Analyst owns iteration until FP acceptable.

Ship: FP test checklist — benign corpus path, match log, refinement note. Next: YARA Lab.

4. What you ship: YARA false positive test checklist

Benign corpus test steps, match logging, refinement loop. $MAL_LAB only. chmod 600.

5. What you record before the next lesson

Date. FP checklist. $MAL_LAB named. File t22-m05-l03-false-positives.txt chmod 600.

6. Wrong vs right: live malware on daily driver vs sandbox

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Deploy rule to production without benign test. Ignore FP on system32.
Right: Write FP test checklist for $MAL_LAB YARA rules. Next: YARA Lab.

Hands-on Exercise