The sky is the limit, so to speak with regards to possible obfuscation tactics that attackers can employ. That said, hex encoding and base64 encoding remain among the most popular encoding mechanisms for a large variety of malware. Writing regular expressions in YARA to match a single hex-encoded string is relatively easy... but what if that string can bE COmpRIseD OF MixED CaSE CharACtErS? Given an arbitrary string, this InQuest Labs tool will produce a regular expression that will match the provided string in a case-insensitive manner. This tool is particularly valuable when writing YARA rules intended to match content within Microsoft Rich Text Format (RTF) documents. For more YARA resources, see our Awesome YARA repository on Github.