Example Offensive Threat Hunting

Apart from the very great tools we already have, I think if we put an extra Icon tool for Custom Yara rules offensive threat hunting. Would be gold. Hence, we are not waiting for custom scan time and as we all know all of the AV's out there are using signature bases which is the nature of AV's.

Now if we go for yara we go for memory base.

Images below are the example (only) where the Yara Icon will reside.

The only drawbacks on this is that, it needs tweaking during Yara Scan. Cause it will eat not much of memory but it will be quite lag depending on the options you're going to use. (ei: recursive, intense)

Yep this is just a Sangfor ES Teaser only..

Any thoughts R&D team?