gwillem/magento-malware-scanner

Simpler rules entry

Closed this issue · 1 comments

Challenges with current system:

  1. Lots of Yara rules syntax is boilerplate and not very dense, we almost exclusively use any of them and either string or regex match.
  2. It is preferred to use any of them instead of all of them (because that allows inclusion in the grep rules) but this is not clear from the existing rules files.
  3. Rules names are mostly arbitrary but have to be unique or Yara will complain.

I propose to create an intermediary layer that abstracts away most of the boilerplate. Rules are entered into text files frontend and backend. Rules are either strings (no quotes or escaping necessary) or regexes (enclosed by / and with proper escapes). Rules are separated by newlines. Extra newlines can be added to group rules. Comments (starting with '#') can be added to indicate a rulename or explain rule logic.

A text2yara builder will convert the text files to proper Yara syntax. It will generate unique rules names based on checksum and possible comment, and group together rules.

More complex rules are still possible, they can be added to complex.yar.

Done in #77