Malware › Module 5 › Lesson 3
False Positives
False positives break trust — test YARA on benign corpus in $MAL_LAB before proposing SOC deployment.
Visual · mal_false_positives
YARA false positive literacy. $MAL_LAB only. Original Cyberlium.
Opening
A rule that fires on Windows system files is worse than no rule — FP hygiene is professional duty.
False positives occur when YARA matches benign files — shared strings in installers, game anti-cheat, or dev tools. Analysts maintain benign corpus (OS files, gold images, common apps) and test every new rule on $MAL_LAB before handoff to detection engineering. Cyberlium teaches FP review as part of YARA literacy — not 'trigger everything' hunting on unauthorized endpoints. Next: YARA Lab.
1. Sources of false positives
Overly short strings, common API names, generic error messages, and loose conditions. Packed benignware may share byte runs with malware — combine conditions (string + filesize + magic).
Document each FP found during $MAL_LAB testing and how condition was tightened.
Command guide
Try these commands — Sources of false positives
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
YARA Python module — https://yara.readthedocs.io/en/stable/yarapython.html MalwareBazaar YARA — https://bazaar.abuse.ch/export/ (defender YARA feed literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install yara sudo apt install python3
macOS:
Command — copy this
brew install yara brew install python3
Windows:
Command — copy this
choco install yara # or use WSL
Download https://python.org/downloads/
═══ LINUX / macOS ═══
Optional command
sudo apt install yara
Command — copy this
source "$HOME/cyberlium-lab/t22-mal/lab.env" 2>/dev/null || export LAB_MAL=$HOME/cyberlium-lab/t22-mal
python3 <<'PY'
from pathlib import Path
import os
lab = os.environ.get('LAB_MAL', os.path.join(os.environ['HOME'], 'cyberlium-lab/t22-mal'))
sample = Path(lab, 'samples/eicar.com.txt').read_text()
rule_hit = 'EICAR-STANDARD-ANTIVIRUS-TEST-FILE' in sample
print('rule EICAR_Test_String:', 'MATCH' if rule_hit else 'miss', '(benign lab simulate)')
PYCommand — copy this
yara -s "$HOME/cyberlium-lab/t22-mal/rules/eicar.yar" "$HOME/cyberlium-lab/t22-mal/samples/"* 2>/dev/null | head -5 || echo 'yara not installed — python simulate above'
Primary tools to practice this lesson: yara, python3. Reference sites: YARA Python module (https://yara.readthedocs.io/en/stable/yarapython.html); MalwareBazaar YARA (https://bazaar.abuse.ch/export/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Benign corpus testing
Scan gold image files, common installers, and org-approved software on $MAL_LAB before production. Record match count: malware set N/N, benign set 0/N target.
Detection engineering may require FP rate threshold before merge to production repo.
3. FP handling in operations
SOC tunes exceptions, adds hash allowlists, or refines rule — never disable logging globally because one bad rule. Analyst owns iteration until FP acceptable.
Ship: FP test checklist — benign corpus path, match log, refinement note. Next: YARA Lab.
4. What you ship: YARA false positive test checklist
Benign corpus test steps, match logging, refinement loop. $MAL_LAB only. chmod 600.
5. What you record before the next lesson
Date. FP checklist. $MAL_LAB named. File t22-m05-l03-false-positives.txt chmod 600.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Deploy rule to production without benign test. Ignore FP on system32.
Right
Write FP test checklist for $MAL_LAB YARA rules. Next: YARA Lab.
Mission: document FP testing
1) List three FP causes. 2) Write benign corpus test steps. 3) Note refinement loop. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Trust erodes with every false alarm — test benign first.
Knowledge Check
APPLY: False positive testing on Cyberlium uses:
Multiple choice
Knowledge Check
APPLY: True or False: Common strings alone make reliable YARA conditions.
True or False
Knowledge Check
APPLY: When YARA matches benign gold image files you should:
Multiple choice