Yara Rules
Last updated
Last updated
Shameless plug
This course is given to you for free by The Perkins Cybersecurity Educational Fund: in collaboration with the Malcore team:
Please consider donating to Fund and registering for Malcore. You can also join the Malcore Discord server here:
Malcore offers free threat intel in our Discord via their custom designed Discord bot. Join the Discord to discuss this course in further detail or to ask questions.
You can also support The Perkins Cybersecurity Educational Fund by buying them a coffee
import
Use to import modules
meta:
Used for comments and metadata, this section is not used in the logic of the rule
strings:
Where you define the context you're looking for
condition:
Where the logic is defined, you set your condition here to determine matches
Imports allow you to access modules within the Yara framework. To use imports all you have to do is import "module"
at the start of the rule.
pe
Analyze PE headers, entry point, etc.
math
Use math functions in conditions
dotnet
Gather attributes out of .NET files
cuckoo
Use dynamic analysis from Cuckoo sandbox
lnk
Get lnk file attributes
console
Provides the ability to log to the console
Meta sections contain the metadata of the rule and are not used within the logic of the rule. It is filled with key/value pairs and can contain pretty much anything.
This is the section where you create your strings to determine if it is the same file or not. All strings must start with a $
character. These are used in the conditions section to refer to the string. The strings section is not actually needed to make a complete rule as long as the conditions section doesn't rely on any strings.
Text strings
Text strings are able to contain subsets of the C language escape sequences such as:
\"
Double quote
\\
Backslash
Carriage return
Tab space
New line
\xdd
Hexadecimal bytes
Modifiers
You can also use modifiers for text string as seen in the above example. Modifiers include:
nocase
No character case constraints
wide
Matches strings encoded with two up to bytes per character
ascii
Standard ascii characters
xor
Single byte Xor applied to the string
base64
Look for the string in a base64 encoding (base64wide
exists as well, you can also set the charset of the encoding)
fullword
Guarantees full word match
private
Will never be included in the output of Yara
Regular expressions
Regular expressions can take the following metacharacters:
\
Quote the next character
^
Match the beginning
.
Matches any single character except new lines
`
Alteration
()
Group
[]
Set of characters
*
Match 0 or more times
+
Match 1 or more times
?
Match 0 or 1 times
{n}
Match exactly n amount times
{n,}
Match at least n amount times
{,n}
Match at most n amount times
{n,n}
Match at least n amount times and at most n amount times
\w
Alphanumeric word character
\W
Any non-word character
\s
Whitespace character
\S
Non-whitespace character
\d
Digit character
\D
Non-digit character
\b
Word boundaries
\B
Except at a word boundary
Conditions are basically just boolean expressions used to establish if the rule matches your comparison.
Operators
[]
Quote the next character
~
Bitwise not
-
Subtraction
.
Structure member access
*
Multiplication
/
Division
%
Remainder
+
Addition
<<
Bitwise left shift
>>
Bitwise right shift
&
Bitwise AND
^
Bitwise XOR
|
Bitwise OR (minus \
)
<
Less than
>
Greater than
<=
Less than or equal to
>=
Greater than or equal to
==
Equal to
!=
Not equal to
[i]contains
String contains substring, adding i
makes it non-case sensitive
[i]startswith
String startswith substring, adding i
makes it non-case sensitive
[i]endswith
String ends with substring, adding i
makes it non-case sensitive
iequals
Non-case sensitive string comparison
matches
String matches regular expression
not defined
Logical NOT check for non-defined expression
and
Logical AND
or
Logical OR
filesize
Checks the file size
at
String offset or virtual address search
entrypoint
Special variable to check the Pe or ELF entrypoint (deprecated)
Accessing data at specific locations
You may need to access data at a certain locations and read 16, 32, or 64bit integers using an offset, use one of the following to read data from them:
You can find an exhaustive breakdown