YARA - Malware Analysis and Threat Detection

Explore the malware landscape with Yara, distinguishing viruses, worms, trojans, ransomware, spyware, bots, and botnets, and learn how each type spreads, conceals, and is analyzed.

Learn how small, functionally equivalent code changes defeat hash-based malware detection, and use Yara pattern matching to identify the same malicious payload across variants.

Yara is an open-source pattern-matching tool for threat hunting and malware analysis, with rules applied to files or in-memory processes, available on GitHub for Windows 64/32-bit.

Explore the anatomy of a Yara rule, including metadata and strings, then build conditions with modifiers like full word, no case, and wide Ascii to detect indicators of compromise.

Adopt the course’s standardized naming convention to write and share YARA rules, using A for application, C for command, f for file, IP, P, R, and s.

Create a static test file by embedding strings in a text file, then run Yara with -s and -m to reveal strings and metadata for positive and negative testing.

Use the strings64 utility to extract string values from a static binary, redirect them to a file, and run Yara against the output for malware detection rules.

Build a static executable test file with embedded Winsock strings for yara rule testing, using a C# console app to enumerate a process id and test the network_udp rule.

Create a dynamic executable test file with a C# harness that reads trigger strings from an external text file and uses Yara to inspect the running process by PID.

Learn to use Yara to identify file types by magic numbers and content, detect executables, PDFs, and JPEGs, and trigger rules from embedded strings and code references for threat detection.

Yara reveals a file's true type by inspecting the magic number, detecting executables even when renamed as benign text, using rules that target 4d5a at the zero position.

Inspect the header with the magic number fd8 at the zero position to verify a jpeg file, triggering a Yara rule on a match for uploaded files to your application.

Apply a magic-number rule to detect pdf files by matching hex value 2550 4446 at the zero position, then test against pdf and non-pdf files and altered extensions.

Use a broad Yara rule to detect suspicious strings like backdoor, virus, hack, and exploit across files; tailor and tighten the rule for your environment to narrow results.

Use Yara rules to identify sensitive data such as PII and PHI, including SSNs, credit cards, and ICD codes, via regular expressions that match data structures.

Explore yara-based code crawling to spot vulnerabilities in source code, including weak ciphers, insecure cryptographic patterns, md5 and des, sql injection, and cross-site scripting.

Explore applying Yara to IIS log files for lightweight pattern searches, inspecting headers and fields to detect specific page requests and inform threat detection and hunting.

Use Yara as a lightweight preprocessor to Apache logs, distinguishing https traffic from http requests and using pattern matching to identify misconfigurations or reconnaissance.

Use Yara to inspect FTP server transaction logs as a lightweight preprocessor, pattern-match for honey accounts and FTP commands, and extend rules for targeted detection.

Use Yara to inspect processes and files for signs of malware network reconnaissance, including trigger strings and embedded commands that indicate network activity or packet capture capabilities.

Explore how malware probes for external ip by using ip lookup sites, and build a yara rule to detect such references with positive and negative testing.

Explore how malware uses packet capture to sniff LAN traffic, and how Yara rules detect packet capture components like NPF, CIS, and Winpcap DLLs in executables.

Explore living off the land networking using common Windows commands for network reconnaissance, and build a Yara rule to detect references to ping, pathping, traceroute, nslookup, netstat, and root print.

Explore how network and covert communications enable malware to receive commands and exfiltrate data, and detect code patterns and trigger strings signaling external communication.

Learn how TCP sockets enable connection oriented communication, the three way handshake, and Winsock commands for setting up, sending, and tearing down a TCP session, and how YARA detects behavior.

Explore how UDP differs from TCP and enables covert channels. Build a YARA rule to detect UDP-capable processes by matching Winsock and System.Net references with a UDP client string.

Explore building a Yara rule to detect outbound smtp activity by matching raw smtp commands such as helo, ehlo, mail from, and mail to, with positive and negative testing guidance.

Detect ftp activity with a yara rule by scanning files for ftp commands such as user, pass, retrieve, and store, and refine to include pwd and list.

Learn to detect IRC communication in files with a YARA rule, flagging join, nick, ping, private message, and user commands to uncover embedded IRC traffic.

Identify DNS stuffing patterns by building a regex-based rule that flags domain references with more than three subdomains, revealing camouflaged malware traffic and covert command-and-control activity.

Detect how files or processes gain the ability to manipulate the operating system. Identify tools, api interactions, host file changes, and trigger strings that indicate compromise.

Learn to detect Windows net command usage with YARA rules, covering net use, net share, net view, net user, and related groups and services, with testing guidance.

Discover how the host file overrides dns in name resolution and how Yara rules detect tampering by watching its path, using positive and negative testing.

Analyze how attackers use metasploit's kill Avi script to disable antivirus and host protections. Detect references to turning off antivirus with yara rules on Windows hosts.

Develop a yara rule to detect references to the advapi32.dll and service commands (create, start, control, query) to identify malware attempting to configure an executable as a Windows service.

Explore certificate injection as an attack on trust by unauthorized installation or manipulation of digital certificates, threatening authenticity, integrity, and confidentiality in internet communications.

Identify malware droppers by inspecting registry run locations, services, startup folders, and common file paths, using a YARA rule to detect references and handle escaped paths.

Identify spyware techniques that monitor user activity and threaten privacy, and examine key logging, screen capture, and audio sniffing using trigger strings and code detection, living off the land approach.

Identify how software keyloggers use the User32 DLL to capture key presses and exfiltrate data, and learn to detect this with a Yara rule targeting GetAsyncKeyState and related functions.

Identify and detect screen capture malware by building a YARA rule that flags User32 and GDI32 usage, specifically bit block transfer and get DC operations, for threat analysis.

Identify potential audio capture malware by inspecting files for a Windows multimedia DLL and associated wave commands such as open, start, reset, add buffer, and close.

Explore how malware can interact with the Windows clipboard and how Yara rules can detect open, close, get, and set clipboard data for threat detection.

Learn to write Yara rules in three ways—references to tools, code to call or invoke, and related string values—and detect remote access tools in processes and files.

Detect and analyze VNC remote access usage by identifying ultravnc.ini references and start VNC and stop VNC commands in files, enabling early warning of potential malicious activity and pivot capabilities.

Explore rdp configuration and detection by examining registry paths, values such as enable admin remote, and commands like net start and asc service control to flag remote desktop use.

Identify telnet server usage on Windows by building a Yara rule that detects references to software\Microsoft\telnet server, highlighting potential unwanted telnet communications.

Learn how malware can remotely access a webcam by detecting references to the avi cap 32 dll and the cap create capture window, using a Yara rule.