detection engineering
Crisol
Anyone can run a YARA rule. The hard part is knowing how good it is: how many false positives it throws against legitimate software and what it actually detects. Crisol turns that into a reproducible number.
The test bench measured a 12.18% false positive rate on 52 legitimate binaries and drove the redesign rule by rule down to 0% with no loss of detection. It then held at 0% on 315.