Malware Detection with YARA Rules

11/16/2020

YARA: yet another rcursive/ridiculous acronym is a tool used to identify and classify malware. YARA depends upon a custom set of rules written and applied to queries to catch common bad actor phrasing. Rules are made up of a few required pieces. More details on writting rules can be found here in the docs

Syntax

Each rule has to start with the word rule, followed by the name or identifier. The identifier can contain any alphanumeric character and the underscore character, but the first character is not allowed to be a digit. There is a list of YARA keywords that are not allowed to be used as an identifier because they have a predefined meaning.

Condition

Rules are composed of several sections. The condition section is the only one that is required. This section specifies when the rule result is true for the object (file) that is under investigation. It contains a Boolean expression that determines the result. Conditions are by design Boolean expressions and can contain all the usual logical and relational operators. You can also include another rule as part of your conditions.

Strings

To give the condition section a meaning you will also need a strings section. The strings sections is where you can define the strings that will be looked for in the file. Let’s look at an easy example.

rule vendor

rule vendor
{
  strings:
    $text_string1 = "Vendor name" wide
    $text_string2 = "Alias name" wide
  condition:
    $text_string1 or $text_string2
}

The rule shown above is named vendor and looks for the strings “Vendor name” and “Alias name”. If either of those strings is found, then the result of the rule is true.

There are several types of strings you can look for:

• Hexadecimal, in combination with wild-cards, jumps, and alternatives.
• Text strings, with modifiers: nocase, fullword, wide, and ascii.
• Regular expressions, with the same modifiers as text strings.

Metadata

Metadata can be added to help identify the files that were picked up by a certain rule. The metadata identifiers are always followed by an equal sign and the set value. The assigned values can be strings, integers, or a Boolean value. Note that identifier/value pairs defined in the metadata section can’t be used in the condition section, their only purpose is to store additional information about the rule.

Predefined Rules

There are several sets of rules that have been written by the community and are free to implement against common well known attacks. These rules can be found here