Simulations cyber security attack types and detection with YARA

Information systems are developing rapidly. Companies move their business processes to information systems and all processes are carried out on these systems. However, it has become important to ensure the security of company data and personal data on the systems. At the same time, the security of the data was compromised by malicious individuals or groups targeting the data of the organizations' information systems. The targeting of organizations by these aggressive individuals or groups is increasing day by day. Therefore, organizations started to use various solutions for cyber security in order to protect their systems. However, these solutions are not enough for organizations that do not have a sustainable cybersecurity infrastructure and physical team, and these organizations cannot avoid being the target of attackers. In the first few sentences, the importance of the subject and the aim of the thesis should be defined and brief information about the method and findings should be presented. Finally, the information produced should be expressed briefly. A company that has been targeted by attackers operates DFIR processes to minimize damage. In DFIR processes, all endpoints in the infrastructure of the institution should be analyzed quickly and all threat elements should be detected and eliminated. This institution is important for the continuation of its activities. In this thesis, the analysis of attack types that are actively used in the cyber world is made. At the same time, these attack types are simulated. A virtual environment with Windows and Linux systems was created in Digital Forensic and Incident Response processes. In this environment, frequently used cyber-attack methods were applied and developed defense mechanisms against these methods. The motivation of this study is to cope with the cyber threats faced by all institutions and organizations. In the application made in the thesis study, it is explained how the malware variants, which are frequently encountered in Windows systems, are detected with manual techniques and YARA, which is one of the open- source solutions.