Andrei Saygo and Jhilakshi Sharma from Microsoft discuss the challenges of identifying software vulnerabilities, particularly on a cloud scale, and the tools used to detect vulnerability patterns. They focus on Yara, a popular tool among Blue teams and malware researchers, known for its ease of use in scanning large collections of files for identified malicious patterns. The speakers explore an alternative use of Yara from an AppSec/Red Team perspective, demonstrating how to create rules that match different types of software vulnerabilities. They discuss examples ranging from arbitrary code execution on GitHub infrastructure to code injection into firmware, and provide tips on making signatures more generic to detect more vulnerabilities. By the end of the presentation, viewers should feel empowered to use Yara to hunt for vulnerabilities.