{"id":2766,"date":"2021-02-15T18:30:27","date_gmt":"2021-02-15T17:30:27","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=2766"},"modified":"2023-12-24T12:34:05","modified_gmt":"2023-12-24T11:34:05","slug":"yara","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=2766","title":{"rendered":"YARA<\/span>"},"content":{"rendered":"\n

Yet anoth\u00ader ridi\u00adcolous acrynom<\/em> is a tool for detect infor\u00adma\u00adtion in bina\u00adry and text files. YARA<\/span> rules are writen in text files. <\/p>\n\n\n\n

By call\u00ading yara with a rule file and a file to test, it either returns noth\u00ading if no rule was detect\u00aded or one or mul\u00adti\u00adple rules which match\u00ades the pro\u00advid\u00aded file.<\/p>\n\n\n\n

Exam\u00adple: The foll\u00adwing rule (file\u00adname detect_virus.yara<\/em>) checks for the string virus<\/em>:<\/p>\n\n\n\n

rule detect_virus {
   strings:
      $detection_string = \"virus\"
   condition:
      $detection_string
}<\/pre>\n\n\n\n
This file can be used as fol\u00adlows to check the file testfile.elf<\/em>:<\/p>\n\n\n\n
yara detect_virus.yara testfile.elf<\/pre>\n\n\n\n
The fol\u00adlow\u00ading rule checks for the occur\u00adrence the strings virus<\/em> and mal\u00adware<\/em>:<\/p>\n\n\n\n
rule detect_virus {\n   strings:\n      $detection_string1 = \"virus\"\n      $detection_string2 = \"malware\"\n   condition:\n      any of them\n}<\/pre>\n\n\n\n
To trig\u00adger detec\u00adtion only if a string occurs mul\u00adti\u00adple times, the con\u00addi\u00adtion can not only be boolean but also com\u00adpare with <=<\/em>, >=<\/em> and !=<\/em>. Fur\u00adther\u00admore, con\u00addi\u00adtions can be com\u00adbined with the key\u00adwords and<\/em>, or<\/em> and not<\/em>. The fol\u00adlow\u00ading rule trig\u00adgers only if the file con\u00adtains the string sig\u00adcode<\/em> at least 5 times.<\/p>\n\n\n\n
rule detect_virus {\n   strings:\n      $detection_string1 = \"sigcode\"\n      $detection_string2 = \"templ\"\n   condition:\n      $detection_string1 >= 5 and $detection_string2\n}<\/pre>\n\n\n\n
Create rules with yarGen<\/h2>\n\n\n\n
After a mali\u00adcious file was detect\u00aded, a new YARA<\/span> rule should be writ\u00adten to detect the file on oth\u00ader sys\u00adtems as well. The tool yarGen<\/a> can help with that by ana\u00adlyz\u00ading the file and pro\u00adpose unique strings which prob\u00ada\u00adbly not appear in goodware.<\/p>\n\n\n\n
  1. Update the yarGen data\u00adbase of good strings with python3 yarGen.py --update<\/code><\/li>
  2. Analyse the file with python3 yarGen.py -m malware_file --excludegood -o new_rule.yar<\/code><\/li><\/ol>\n\n\n\n
    Additional ressources<\/h2>\n\n\n\n