Yet anoth­er ridi­colous acrynom is a tool for detect infor­ma­tion in bina­ry and text files. YARA rules are writen in text files. 

By call­ing yara with a rule file and a file to test, it either returns noth­ing if no rule was detect­ed or one or mul­ti­ple rules which match­es the pro­vid­ed file.

Exam­ple: The foll­wing rule (file­name detect_virus.yara) checks for the string virus:

rule detect_virus {
   strings:
      $detection_string = "virus"
   condition:
      $detection_string
}

This file can be used as fol­lows to check the file testfile.elf:

yara detect_virus.yara testfile.elf

The fol­low­ing rule checks for the occur­rence the strings virus and mal­ware:

rule detect_virus {
   strings:
      $detection_string1 = "virus"
      $detection_string2 = "malware"
   condition:
      any of them
}

To trig­ger detec­tion only if a string occurs mul­ti­ple times, the con­di­tion can not only be boolean but also com­pare with <=, >= and !=. Fur­ther­more, con­di­tions can be com­bined with the key­words and, or and not. The fol­low­ing rule trig­gers only if the file con­tains the string sig­code at least 5 times.

rule detect_virus {
   strings:
      $detection_string1 = "sigcode"
      $detection_string2 = "templ"
   condition:
      $detection_string1 >= 5 and $detection_string2
}

Create rules with yarGen

After a mali­cious file was detect­ed, a new YARA rule should be writ­ten to detect the file on oth­er sys­tems as well. The tool yarGen can help with that by ana­lyz­ing the file and pro­pose unique strings which prob­a­bly not appear in goodware.

1. Update the yarGen data­base of good strings with python3 yarGen.py --update
2. Analyse the file with python3 yarGen.py -m malware_file --excludegood -o new_rule.yar

Additional ressources

• Doc­u­men­ta­tion about rules
• Cheat­sheet