[Autogenerated] building high fidelity detections for
malware is where Yara comes into play with.
The main advantage that it overcomes traditional
hash based signature limitations.
Yara enables us to identify specific byte sequences and patterns,
there is also rural mechanism based on conditions.
Yara is a very popular format adopted by many security
tools as a common language detection.
Using your rules from python can be achieved by
leveraging the er a python module.
Rules must be compiled using Yara, compiled and based on this,
a rule can match against the fall.
The result will contain the name of the rule that was triggered,
including the metadata and specific strings.
There is no replacement for some hands on experience.
We'll start off this demo by going over the
documentation for the your app python module,
then we'll install it using pip and will leverage a rule to detect
malicious patterns against a set of suspicious files.
The starting point for this demo is the Yarra python module documentation.
This provides insight into the core functionality and also all
other important details and feel free to pause the video and
explore this in much more depth.
Next I will build a detection function so you can get a
better understanding of the true value of this module but
first I need to install it using pip.
Once this is done, I need to add this to the import list.
Now I'm able to start creating the new function.
This will be called match Yara and will receive two arguments one the
path to the file that will be scanned and the second,
the path to the rule file that will be used.
And speaking of Rule I want to show you the rule that I put together the files.
Yara,
Rule that er contains a couple of interesting rules for executable
macro enabled documents and also rule based on an I.
P address.
On a side note, if you want to get syntax highlighting for Yara,
that is an extension for this and it's called the Ara.
Now returning to the function first,
I compiled the rule based on the rule file path and then get
the list of matches for the file that is scanned since there
might be multiple matches,
I will iterate through them in a for loop and print
out the rule name for your a scans.
I will add a new argument to our main script and we'll call this
Terrascan since I need the path to the rule file,
I will not use the action equals store true.
Instead I will use a metaphor to define the path to the euro
Rule file in the main part of the script,
I will use another if to check if the Terrascan argument has been provided.
I will then check if the path to the rule file exists
and iterate through all of the files.
Now let's test this,
I will call this for file one and use the UR rule file as an argument
as well and we can notice that the fall isn't executable next I will
run this for the entire directory and expand the window a bit And
notice some more interesting things.
File five contains office Macros and also they will try to run
automatically when the file is opened From a previous demo file to
entry had the same import hash but we notice that only file tree has
been flagged by the back door custom rule so it might be that this
beacon to different C2 addresses.
We have now implemented some very interesting functionality and in the next
part we can enrich this by using other services as well.
Yara is an advanced detection and analysis capability,
which can provide a lot of opportunities to enhance detection If
used to develop yourself further in this domain,
you can continue your journey with a threat hunting with Yara course