These next few topics can literally be whole courses in themselves.
I cannot possibly cram everything into a few minutes,
so I'm only going to focus on the pieces I feel you will
touch on the most in this profession and leave it up to you
to research the rest on your own.
As usual, project information is on the python.org website.
YARA is not developed specifically for Python.
It was developed by a software engineer at VirusTotal to aid malware
researchers and quickly disperse the detection information.
When we talk about regex and identifying patterns,
that is exactly what YARA was established to do,
to find the patterns of various malware,
making it easier to develop tools and languages,
such as Python,
to detect and hunt malware in your systems. An official full
write up of what is available for YARA can be found on the
readthedocs site. I have posted here the specific callout to the
site of the Python implementation.
Finally, in order to implement,
we must first pip install in order to import. The YARA rule template is
broken down as such. At the top, the name of the rule. Basically, what do we
call this once detected? Inside the rule is your optional metadata where you
can put add‑on information about the rule.
Some examples used here include who is the author of the rule,
when was the rule created, and last modified.
There are no defined names here, but there are
reserved keywords that cannot be used.
The strings and condition sections are the heart of the rule.
The string section allows you to define any variables which
contain the pattern to be identified.
Now think back to our clips on the regular expression.
You can have defined text, hex or pull out the regular
expression sequences and define the pattern.
The condition section contains the defined expressions
that will return a Boolean response based on whether or
not the expression has been met.
Looking at a few examples we pulled out of the public YARA repositories,
the Tofu_Backdoor is looking for a specific cookie, pipe or
set of hex, and if any of them are found,
the back door has been discovered and returned a true result.
The example_rule rule has a few defined meta strings,
one of them being whether this is a threat in the wild or actively being
exploited and what the default risk score is for that threat. Similar to the
last rule, because of the or operators throughout the condition, if any one
of these strings is found in the file, the alert will pop off.
There are just two functions we want to look at today.
First, the compile function. Before you can scan a file,
you must first compile the rules into a binary that can be pulled
into a match function and compare the file or files you are wanting
to check against the rules. When you have the specific markers an
emerging zero‑day threat contains along with where in the file
system is known to attack,
you can create your own YARA rule and check systems with your
own homemade Python script to conduct a threat hunt of your
environment. With YARA, you will need to pip install the YARA
package as it is a third party.
Once that is ready, you will be able to use the compile
and match functions. In this demo,
I am setting the directory I want to scan and compiling the rule I
want to run against that directory. In this demo,
I am only compiling the one rule.
This may be the case when you're checking for a known indicator of compromise.
I then run a quick for loop of every file in the defined directory,
comparing it against that YARA rule using the match function.
If there is a match,
I throw the file name and warning message. And in
this case, if there is no match,
I also throw the file name in a Clean remark. Running this now, I can see it
scan through all my scripts and return that they are all Clean.
This should make you feel better about downloading them later.