Anonymous YARA Rules Are Not Anonymous: Classifiers Identify Contributing Organizations from Rule Text Alone

arXiv·medium signal

Isah, Bobelin, and Berthomé demonstrate that stripping metadata from YARA rules does not protect contributor identity. Using 23,305 rules from three major public repositories, they train classifiers that reliably identify the contributing organization from rule text alone. This challenges a core assumption in threat intelligence sharing — that anonymization via metadata removal sufficiently protects participants.