/YARA-Malware-Detection

This repository contains information about YARA rules for identifying malware. This includes installing, running, and writing rules for YARA.

YARA-Malware-Detection

This repository contains information about YARA rules for identifying malware. This includes installing, running, and writing rules for YARA.

TOC

Installing YARA

Writing YARA Rules

  • YARA rule components:
    • Rule name
    • Characteristics of applying the rule to files
    • Conditions when a file should be flagged by the rule
  • YARA rule example in a .YARA file: 
      rule HelloString : Hello
  {
      strings:
              $a = "Hello"

      condition:
              $a

  }
    • First line defines the rule as "HelloString" and shorthand name of "Hello"
    • Variable $a is used to hold value of "Hello"
    • The condition declares that any scanned file that contains the string of "Hello" will be flagged
  • Another rule example searching for Hello: 
      rule HelloString : Hello
  {
      meta:
              description = "File detected containing string Hello"
              threat_level = "Very Low"
      strings:
              $a = "Hello"
              $b = "choclate"
              $c = "cookies

      condition:
              $a

  }
  • Another rule example searching for Hello, chocolate or cookies:
   rule HelloString : Hello
   {
       meta:
               description = "File detected containing string Hello, chocolate, or cookies"
               threat_level = "Very Low"
       strings:
               $a = "Hello"
               $b = "choclate"
               $c = "cookies

       condition:
               $a or $b or $c

   }