How to write YARA rules for improving your security and malware detection

2 years ago 263

YARA won't regenerate antivirus software, but it tin assistance you observe problems much efficiently and allows much customization. Learn however to constitute YARA rules to amended information and incidental effect .

In our first article astir YARA, we defined what benignant of instrumentality it was and successful which discourse it could beryllium used: detecting malware connected the web oregon connected endpoints, helping incidental effect and monitoring, classifying files oregon adjacent detecting delicate information leaks. We besides showed however to instal it. Now it's clip to constitute rules to get the champion retired of it.

SEE: Google Chrome: Security and UI tips you request to know (TechRepublic Premium)

Use an bare template to commencement

YARA rules are substance files, which travel a precise basic, yet powerful, syntax.

YARA rules ever incorporate 3 parts:

The meta part: This portion contains wide oregon circumstantial accusation that is not processed but serves the idiosyncratic to recognize what it is about.
The strings part: This portion contains each the strings that request to beryllium searched for successful files.
The information part: This portion defines the information for matching. It tin beryllium conscionable matching 1 oregon respective strings, but it tin besides beryllium much analyzable arsenic we volition spot aboriginal successful this article.

From my experience, it is powerfully advised to make an bare template that you volition ever usage to commencement penning a caller rule. This way, you conscionable request to capable a fewer adaptable contents and adhd the desired conditions.

rule samplerule{meta:author="Cedric Pernet"version="0.1"date="2021/05/12"reference="any utile reference"strings:condition:}

Using this template, you tin rapidly edit the metadata and the regularisation sanction (in our illustration it is named samplerule). The metadata tin beryllium conscionable thing the idiosyncratic wants to enactment there. As for me, I ever usage a mentation number, a date, a notation which could beryllium a malware hash, oregon a blog study that mentions what I privation to detect, and an writer field.

Now that the metadata is written, let's commencement penning retired the archetypal rule.

A archetypal regularisation

YARA rules are a operation of strings elements and conditions. The strings tin beryllium substance strings, hexadecimal strings oregon regular expressions.

The conditions are boolean expressions, conscionable similar successful different programming languages. The astir known are AND, OR, NOT. Relational, arithmetic and bitwise operators tin besides beryllium used.

Here is simply a archetypal rule:

rule netcat_detection{meta:author="Cedric Pernet"version="0.1"date="2021/05/12"reference="netcat is simply a escaped instrumentality disposable freely online"strings:$str1="gethostpoop fuxored" // this is precise circumstantial to the netcat tool$str2="nc -l -p larboard [options]"condition:$str1 oregon $str2}

So fto america explicate this regularisation titled netcat_detection.

After our accustomed metadata, the strings part contains 2 variables, str1 and str2, which of people mightiness beryllium named immoderate mode we like. Also, to exemplify however to adhd comments, the archetypal adaptable contains 1 remark astatine the extremity of it.

The information portion contains the pursuing condition: It indispensable lucifer either str1 oregon str2.

This could person been written successful a much comfy way:

condition:any of ($str*)

This tin beryllium utile if we person a batch of antithetic variables and we privation to conscionable lucifer connected immoderate of it.

Running the archetypal regularisation

Let's present tally our rule, which we saved arsenic a record named rule1.yar. We privation to tally it against a folder containing respective antithetic files, 2 of them being the 32- and 64-bits versions of the netcat bundle (Figure A). Our strategy is for investigating is simply a Ubuntu Linux distribution, but it does not substance arsenic Yara tin beryllium installed easy connected Linux, Mac oregon Windows operating systems.

Figure A

As expected, YARA runs and returns the names of each files matching the rule.

Of course, 1 tin enactment arsenic galore YARA rules arsenic wanted successful a azygous file, which makes it much comfy than having a batch of antithetic regularisation files.

Running YARA with -s enactment shows the nonstop strings which person matched those files (Figure B):

Figure B

On a broadside note, uncovering tools similar netcat determination successful your firm web mightiness so beryllium worthy investigating: That basal instrumentality should not beryllium recovered connected the mean idiosyncratic computer, since it allows computers to link and speech information connected circumstantial ports and mightiness beryllium utilized by attackers. It mightiness also, of course, beryllium utilized by IT radical oregon reddish squad staff, hence the probe to find wherefore it was recovered connected a instrumentality from the firm network.

More analyzable strings

Matching a basal drawstring tin beryllium capable for uncovering files wrong systems. Yet strings mightiness beryllium encoded otherwise connected antithetic systems oregon mightiness person been somewhat triggered by attackers. One flimsy change, for example, tin beryllium to alteration the lawsuit of strings utilizing random precocious and little case. Luckily enough, YARA tin grip this easily.

In the pursuing YARA strings part, a drawstring volition lucifer nary substance what lawsuit it uses:

strings:$str1="thisisit" nocase

The information $str1 volition present lucifer with immoderate lawsuit used: "ThisIsIt", "THISISIT", "thisisit","ThIsIsiT", etc.

If strings are encoded utilizing 2 bytes per character, the "wide" modifier tin beryllium used, and tin of people beryllium combined with different one:

strings:$str1="thisisit" nocase wide

To hunt for strings connected some the ASCII and wide form, the modifier "ascii" tin beryllium utilized successful conjunction with wide.

strings:$str1="thisisit" ascii wide

Hexadecimal strings

Hexadecimal strings tin beryllium utilized easily:

strings:$str1={ 75 72 65 6C 6E 20 }$str2={ 75 72 65 6C ?? 20 }$str3={ 75 72 [2-4] 65 6C }

Here are 3 antithetic hexadecimal variables. The archetypal 1 searches for an nonstop series connected hexadecimal strings. The 2nd 1 uses a wildcard expressed with 2 ? characters and volition hunt strings with conscionable immoderate hexadecimal worth wherever the ?? stands.

SEE: Password breach: Why popular civilization and passwords don't premix (free PDF) (TechRepublic)

The 3rd drawstring searches for the 2 archetypal bytes, past a leap of 2 to 4 characters, past the 2 past bytes. This is precise useful erstwhile immoderate sequences alteration successful antithetic files but amusement a predictable fig of random bytes betwixt 2 known ones.

Regular expressions

Regular expressions, conscionable similar successful immoderate programming language, are precise utile to observe peculiar contented that tin beryllium written successful antithetic ways. In YARA, they are defined by utilizing a drawstring that starts and ends with the slash (/) character.

Let's instrumentality an illustration that makes sense.

In a malware binary, the developer near debug information, successful peculiar the celebrated PDB string.

It reads:

D:\workspace\Malware_v42\Release\malw.pdb

Now the thought would beryllium not to lone make a regularisation that would lucifer this malware, but each the antithetic versions of it successful lawsuit the mentation fig changes. Also, we decided to exclude the "D" thrust from the rule, since the developer could besides person it connected different drive.

We travel up with regular look (Figure C):

Figure C

For objection purposes, we built a record named newmalwareversion.exe which contains 3 antithetic PDB strings, each with a antithetic mentation number. Our regularisation matches them all.

Please enactment that the \ characters from our strings person been doubled, due to the fact that \ is simply a peculiar quality which needs to beryllium escaped, similar successful C language.

More analyzable conditions

Conditions tin beryllium smarter than conscionable matching a azygous oregon respective strings. You tin usage conditions to number strings, to specify an offset astatine which you privation to find a string, to lucifer a record size oregon adjacent usage loops.

Here are a fewer examples which I commented for explanation:

condition:2 of ($str*) // volition lucifer connected 2 of respective strings named str followed by a number($str1 oregon $str2) and ($text1 oregon $text2) // illustration of Boolean operators#a == 4 and #b > 6 // drawstring a needs to beryllium recovered precisely 4 times and drawstring b needs to beryllium recovered strictly much than six times$str astatine 100 // drawstring str needs to beryllium located wrong the record astatine offset 100$str successful (500..filesize) // drawstring str needs to beryllium located betwixt offset 500 and extremity of file.filesize > 500KB // Only files which are much than 500KB large volition beryllium considered

Conclusion

This nonfiction shows the astir basal capabilities of YARA. We could not papers everything, of course, since it is truly a benignant of programming language. The possibilities offered by YARA for matching files are rather endless. The much the expert gets comfy with YARA, the much helium oregon she volition get the consciousness for it and amended their skills to constitute much businesslike rules.

Since the connection is truthful casual to constitute and use, it is much a substance of knowing what 1 truly wants to detect. It has go progressively communal done the past years to spot information researchers people YARA rules successful appendices of their probe papers and blog posts, successful bid to assistance everyone lucifer malicious contented connected their computers oregon servers. YARA rules besides let to lucifer contented that is not malicious but needs to beryllium cautiously monitored, similar interior documents for example, rendering YARA into a information nonaccomplishment detection instrumentality arsenic good arsenic a malicious contented detector. One should not hesitate to consult the YARA documentation to spot each possibilities offered by the tool.

Cybersecurity Insider Newsletter

Strengthen your organization's IT information defenses by keeping abreast of the latest cybersecurity news, solutions, and champion practices. Delivered Tuesdays and Thursdays