YARA

YARA#

YARA is an open source tool aimed at helping researchers identify and classify malware samples. With YARA the operator writes descriptions of malware families based on textual or binary patterns. Each rule is a set of strings and a Boolean expression that decides whether the sample matches.

Meta#

The metadata section holds user-assigned values that travel with the rule. Author, description, license, threat references.

Strings#

Three string types in YARA.

  • Hexadecimal, optional wildcards, jumps, alternatives.

    { E2 34 ?? C8 A? FB }            # wildcards
{ F4 23 [4-6] 62 B4 }            # jumps
{ F4 23 ( 62 B4 | 56 ) 45 }      # alternatives

  • Text.

    "text"                # case-sensitive
"text" nocase         # case-insensitive
"text" wide           # wide character
"text" fullword       # full words only

  • Regular expressions, the usual metacharacters apply.

    Token

    Meaning

    \

    Quote the next metacharacter.

    ^

    Match the beginning of the file.

    $

    Match the end of the file.

    |

    Alternation.

    ()

    Grouping.

    []

    Bracketed character class.

Quantifiers.

Token

Meaning

*

Match 0 or more times.

+

Match 1 or more times.

?

Match 0 or 1 times.

{n}

Match exactly n times.

{n,}

Match at least n times.

{,m}

Match 0 to m times.

{n,m}

Match n to m times.

*?, +?, ??, {n}?, {n,}?, {,m}?, {n,m}?

Non-greedy variants.

Escape sequences.

Token

Meaning

\t

Tab (HT, TAB).

\n

New line (LF, NL).

\r

Return (CR).

\f

Form feed (FF).

\a

Alarm bell.

\xNN

Character whose ordinal number is the given hexadecimal number.

Character classes.

Token

Meaning

\w

Match a word character (alphanumeric plus _).

\W

Match a non-word character.

\s

Match a whitespace character.

\S

Match a non-whitespace character.

\d

Match a decimal digit character.

\D

Match a non-digit character.

Zero-width assertions.

Token

Meaning

\b

Match a word boundary.

\B

Match except at a word boundary.

Condition#

Conditions are Boolean expressions that must be met.

  • Boolean (and, or, not).

  • Relational operators (>=, <=, <, >, ==, !=).

  • Arithmetic operators (+, -, *, \, %).

  • Bitwise operators (&, |, <<, >>, ~, ^).

Example rule#

rule ExampleRule
{
    meta:
        author = "netmux"
        description = "Detects Emotet binary"
        license = "Free as in beer"
    strings:
        $ex_text_string = "text string" nocase
        $ex_hex_string = { E2 34 A1 C8 23 FB }

    condition:
        $ex_text_string or $ex_hex_string
}

Uncoder#

Uncoder.io translates saved searches, filters, queries, API requests, correlations, and Sigma rules across SIEM dialects (Sigma, ArcSight, Azure Sentinel, Elasticsearch, Graylog, Kibana, LogPoint, QRadar, Qualys, RSA NetWitness, Regex Grep, Splunk, Sumo Logic, Windows Defender ATP, Windows PowerShell, X-Pack Watcher).

References#

Contents