Custom rules
Workspace-specific detections
Analyst, Team, and Enterprise accounts can layer private YARA and EQL detections on top of Bintracer's built-in rules.
YARA rules
Upload private YARA rules as plaintext .yar or .yara files. They are compiled with YARA-X and matched against the uploaded sample (for app bundles, the bundle's main executable) during static analysis.
EQL rules
Upload EQL detection rules as .toml files in the Elastic detection-rule format. After every detonation, your rules are evaluated against the process, file, and network telemetry recorded in the sandbox, alongside Bintracer's built-in rules.
Account scope
Active rules run on every scan your account submits. Their matches stay account-visible and are never exposed to other viewers of a public report.
Writing an EQL rule
An EQL rule is a TOML file with a [rule] table carrying a name, type = "eql", the query, and the event indices it searches. An optional [[rule.threat]] block maps the rule to MITRE ATT&CK, which is shown with matches on the scan report. This example flags LaunchAgent persistence written during execution.
[rule]
name = "Persistence via LaunchAgents Directory"
rule_id = "my-team-launchagent-write"
type = "eql"
language = "eql"
index = ["logs-bintracer.events.file-*"]
query = '''
file where event.action in ("creation", "modification") and
file.path like~ ("/Users/*/Library/LaunchAgents/*.plist",
"/Library/LaunchAgents/*.plist")
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[rule.threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"
[[rule.threat.technique.subtechnique]]
id = "T1543.001"
name = "Launch Agent"
reference = "https://attack.mitre.org/techniques/T1543/001/"
Each rule is evaluated against only the telemetry of the scan under review, so queries never need to filter by scan, account, or time range. When a query matches, the scan report lists the rule with its ATT&CK techniques under the behavior results.
Upload limits
- Rule files are plaintext: .yar or .yara for YARA, .toml for EQL, up to 1 MiB per file.
- Each account can store up to 10000 custom rules.
- Rules are validated in the browser before upload, and you can edit active rules in place from the Rules page.
- A rule the scan pipeline cannot load is skipped instead of failing your scan.