Carbon Black App Control includes several pre-configured YARA rules, which are enabled by default. You can view these rules on the YARA Rules page, for example, to help you identify information about the purpose of a tag you see assigned to a file so that you know how to use that tag.

Important: All pre-configured YARA rules are enabled by default and cannot be modified.

To get familiar with YARA rule parameters, see YARA Rule Parameters.

For a list of the YARA tags that have predefined meanings, see YARA Rule Tags.

To get familiar with YARA CBEP attributes, see YARA CBEP Attributes.

Table 1. Common Attributes for Pre-configured YARA Rules
Attribute Description
Status Enabled
Read Only Yes
Date Modified Date when the rule was last updated by the server.
Last Modified By User name of the user who last updated the rule.
Date Created Date when the rule was first added to the server.
Created By User name of the user who created the rule.
Table 2. Pre-configured YARA Rules
YARA Rule Name Namespace Description Qualifiers
16-bit COM Executables IsInteresting Identifies 16-bit executables
7zip Archives IsInteresting Identifies 7zip files as crawlable archives <OnlyIf:DBQueryNonZero:select count(*) from crawlpath where crawlpath_enabled = 1>
Bzip Archives IsInteresting Identifies bzip and bzip2 files as crawlable archives <OnlyIf:DBQueryNonZero:select count(*) from crawlpath where crawlpath_enabled = 1>
Chrome Extension Interpreter Classification Identifies interpreters for Chrome extensions
Cmd Script Interpreter Classification Identifies Interpreters for cmd/bat scripts
EICAR IsInteresting Identifies EICAR signature
Embedded Archives IsInteresting Identifies executables with embedded archives as installers
Embedded Executables IsInteresting Identifies executables that contain other executables as install
FileHeader IsInteresting File header for the IsInteresting rule set. Includes any import.
FileHeader Classification File header for the Classification rule set. Includes any import.
Gzip Archives IsInteresting Identifies gzip files as crawlable archives <OnlyIf:DBQueryNonZero:select count(*) from crawlpath where crawlpath_enabled = 1>
Inno Setup Installers IsInteresting Identifies InnoSetup executable installers
Install Shield Installers IsInteresting Identifies Install Shield executable installers
Install4J Installers IsInteresting Identifies installers built using install4J
InstallShield Archives IsInteresting Identifies install shield files as crawlable archives <OnlyIf:DBQueryNonZero:select count(*) from crawlpath where crawlpath_enabled = 1>
ISO Archives IsInteresting Identifies ISO files as crawlable archives <OnlyIf:DBQueryNonZero:select count(*) from crawlpath where crawlpath_enabled = 1>
Jar Archives IsInteresting Identifies jar files as crawlable archives <OnlyIf:DBQueryNonZero:select count(*) from crawlpath where crawlpath_enabled = 1>
Java Script Interpreter Classification Identifies Interpreters for Java scripts
Microsoft Cabinet Files IsInteresting Identifies Microsoft Cabinet files as a crawlable archive <OnlyIf:DBQueryNonZero:select count(*) from crawlpath where crawlpath_enabled = 1>
Microsoft HTML Application Interpreter Classification Identifies Interpreters for HTML applications
Mozilla Extension Interpreter Classification Identifies interpreters for Mozilla extensions (Firefox browser)
Msiexec detector Classification Identifies msiexec
NetOp System File Installers IsInteresting Identifies NetOp System File installers
Nullsoft Installers IsInteresting Identifies Nullsoft self-extracting installers
Perl Script Interpreter Classification Identifies Interpreters for perl scripts
Portable Executable IsInteresting Identifies win32 portable executables and dlls
Powershell Script Interpreter Classification Identifies Interpreters for powershell scripts
PowerShell Scripts Classification Classifies powershell scripts that can execute memory
Python DistUtils Installers IsInteresting Identifies installers built using pythons distutil library
Python Script Interpreter Classification Identifies Interpreters for python scripts <OnlyIf:Bit9Version:Atleast:8.0.0.2454>
Rar Archives IsInteresting Identifies rar files as crawlable archives <OnlyIf:DBQueryNonZero:select count(*) from crawlpath where crawlpath_enabled = 1>
Reg Script Interpreter Classification Identifies Interpreters for reg scripts
Resource Installers IsInteresting Identifies installers based on strings in the resources
Ruby Script Interpreter Classification Identifies interpreters for Ruby scripts
Self-extracting Executables IsInteresting Identifies self-extracting executables as installers
Systems Management Server Installers IsInteresting Identifies Microsoft SMS installers
Tar Archives IsInteresting Identifies tar files as crawlable archives <OnlyIf:DBQueryNonZero:select count(*) from crawlpath where crawlpath_enabled = 1>
TCL Kit Installers IsInteresting Identifies installers built using TCL Kit
UPX Packing detector Classification Identifies UPX packed exes
VB Script Interpreter Classification Identifies Interpreters for vb scripts
WIM Archives IsInteresting Identifies wim files as crawlable archives <OnlyIf:DBQueryNonZero:select count(*) from crawlpath where crawlpath_enabled = 1>
Windows Installers IsInteresting Identifies windows installers (MSI and MSP)
Wise Installers IsInteresting Identifies wise installers
Zip Archives IsInteresting Identifies zip files as crawlable archives <OnlyIf:DBQueryNonZero:select count(*) from crawlpath where crawlpath_enabled = 1>