What Are YARA Rules?

YARA rules are a powerful tool for digital forensic researchers and analysts, enabling them to identify and classify malware samples, detect intrusions, and uncover hidden artifacts. These rules are based on textual or binary patterns found in files or memory, allowing for precise and efficient detection of malicious or suspicious activity.

The system was designed to make it simpler for security professionals and DFIR teams to specify search procedures quickly and efficiently. The text-based language is meant to be both easy to understand and simple for tools to parse. Teams can define new rules on the fly and update their filtering while in the field.

The name dates to 2013 when Victor Alvarez released one of the first versions. The name is a bit of a joke, an abbreviation of “YARA: Another Recursive Acronym” or “Yet Another Ridiculous Acronym.”

How are YARA rules structured?

YARA rules are composed of three main elements:

  1. Rule Definition: Each rule is defined within a block starting with the rule keyword followed by the rule name. The rule name must be unique and should reflect the purpose of the rule. The rule names are often defined in tables that DFIR teams can use to guide search. The name should be descriptive enough to enable fast decisions.
  2. Meta: This section provides metadata about the rule, such as a description, author, and threat level. These should be concise but include enough information so that teams can understand the provenance as the rules evolve over time.
  3. Strings: This section defines the strings or patterns that the rule will search for in the target file or memory. Strings can be literal text, regular expressions, or binary sequences. Some common sequences may require escape characters.
  4. Condition: This section specifies the logical expression that determines whether a match is identified. The condition can combine multiple strings using operators like and, or, and not.

Some researchers like to define multiple rules with greater or lesser precision by adding or subtracting extra search strings. They can deploy the different versions as conditions demand.

What are some of the applications in Digital Forensics and DFIR?

YARA rules play a crucial role in various aspects of digital forensic research and evidence collection:

  1. Malware Identification and Classification: YARA rules can be used to identify specific malware families or variants based on their unique patterns. This allows investigators to categorize malware samples and understand the scope of an attack. Researchers often check to see that the search strings are unique or at least uncommon to avoid false positive events.
  2. Intrusion Detection: Security systems that want to detect malicious activity in real-time may use YARA rules to specify patterns that may be found in emails, data in transit or even running binary executables.
  3. Hidden Artifact Discovery: YARA rules can be employed to uncover hidden artifacts or indicators of compromise (IOCs) that may have been intentionally concealed by attackers inside normal data files. This includes searching for embedded strings, file modifications, or unusual registry entries.

What are the main benefits of Using YARA Rules?

YARA rules offer several advantages for digital forensic investigations:

  1. Speed and Efficiency: YARA rules can scan large volumes of data quickly, enabling investigators to identify relevant evidence efficiently.
  2. Precision: Investigators can reduce the risk of false positives by narrowing down the scope of analysis through extra search strings joined in b
  3. Flexibility: YARA rules can be adapted to new threats and evolving techniques, providing a versatile tool for ongoing investigations.
  4. Community Collaboration: YARA rules can be shared and modified within the cybersecurity community, fostering collaboration and knowledge sharing.
  5. Textual Structure: Using a standard, text-based specification allows researchers and investigators to use many standard tools like text editors or integrated development environments.
  6. Repository Compatible: Many source code repositories like Git offer special features for tracking changes to text-based files. Teams can track who made changes and when. They can also create multiple versions or branches for certain investigations.

What are some good examples of YARA rules?

YARA rules are stored in plain text files with a .yar or .yara extension. These files are structured in a specific format that defines the rule’s metadata, strings, and condition. The YARA file format is relatively straightforward and can be easily read and edited using a plain text editor. The format will be familiar to researchers who edit JSON or YAML files, but there are a few differences. YARA rules are designed to be more efficient than JSON files with less punctuation.

YARA files also allow for the definition of variables which can contain long search strings. This makes it simpler to specify boolean conditions.

YARA files also include some conventions that simplify writing rules. Variables begin with a dollar sign. Rules can specify the number of times a string appears by replacing the dollar sign with a number sign. That is, $variable and #variable.

 

Basic Structure

rule example_rule {

meta:
description = "A human readable description that’s kept short. "

strings:
$greeting = "You’ve received a $150 million inheritance!"

condition:
$greeting

}

 

Example 1: Detecting Malicious URLs

This rule identifies URLs associated with known phishing or malware distribution campaigns:

rule phishing_urls {

meta:
description = "Detects URLs associated with phishing or malware distribution"

strings:
$phishing_url1 = "https://example.com/phishing/"
$phishing_url2 = "https://example.com/malware/"

condition:
any of ($phishing_url1, $phishing_url2)

}

Example 2: Identifying Emotet Malware

This rule targets specific strings and patterns associated with Emotet malware:

rule emotet {

meta:
description = "Detects Emotet malware"

strings:
$emotet_string1 = "QWRvYWQmYXJlIHlvdSB3YW50IHRvIHJlYWRhIGFueSBtb2JlIGZpbGVzLg=="
$emotet_string2 = "QWRvYWQmYXJlIHlvdSB3YW50IHRvIHJlYWRhIGFueSBwZGZzLg=="

condition:
all of ($emotet_string1, $emotet_string2)

}

 

Example 3: Uncovering Hidden Registry Entries

This rule searches for suspicious registry keys linked to malware activity:

rule hidden_registry {

meta:
description = "Detects suspicious registry keys"

strings:
$hidden_key = "\Soft\SomeApp\SomeValue"

condition:
1 == registry_get_value($hidden_key)

}

Example 4: Identifying Specific File Formats

This rule targets files with a particular extension and internal structure, such as PE executables:

rule pe_file {
meta:
description = "Detects PE executable files"
strings:
$pe_header = "MZ"
condition:
1 == filesize() and $pe_header at 0
}

Example 5: Searching for Specific File Signatures

This rule identifies files based on their unique hexadecimal signatures:

rule specific_file {

meta:
description = "Detects files with specific signatures"

strings:
$file_signature1 = hex("4D5A9000")
$file_signature2 = hex("50450000")

condition:
any of ($file_signature1, $file_signature2)

}

 

What are some of the key takeaways for forensic leadership?

  • YARA files allow researchers to specify search signatures in a compact but human readable tex file.
  • Researchers can use all of the infrastructure for maintaining text-based code like editors, integrated development tools and source code repositories.
  • Teams can quickly edit files or turn them on or off while in the field.
  • Teams can also build a team culture and a strong historical record of signatures using source code repositories like GIT.