Introduction
This is the first post in an ongoing series about YARA and its exceptional ability to carve inside of binaries, documents, photos, and other types of files to uncover and match patterns. The additional posts in the series will give anyone who is thinking about gaining YARA skills the ability to start from scratch and get comfortable with the tool’s functionality. Each post will advance in skill level and include some of the personal and professional standards we follow to instill good habits early on in the learning process.
The quickest way to get our hands on keyboard is getting set up (takes 5 minutes if that) and then diving straight into a practical example. This type of approach is best because everyone can get started in just a few minutes and start enjoying the tool. One last thing is we do want to note that having something other then the manual to read (though one of the best resources) is just a different learning method that may work better for some people. Having a bit more experience with the tool can make reading the manual a lot more interesting as you pick up additional ways to utilize the tool that you have not thought about otherwise. Let’s get started!
Installing YARA to run on the appropriate operating system
Mac
Install Homebrew from the terminal<br>
- hit “command + spacebar” and type terminal then hit enter
Run the following command
- /usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"
Run the following command to complete the installation of YARA
- brew install yara<br>
Windows
Windows YARA runs on a .EXE file that can be obtained from visiting one the links provided for your windows operating system.<br>
[Yara-v3.10.0-904-win32.zip](https://github.com/VirusTotal/yara/releases/tag/v3.10.0) OR [Yara-v3.10.0-904-win64.zip](https://github.com/VirusTotal/yara/releases/download/v3.10.0/yara-v3.10.0-904-win64.zip)<br>
Unzip the file and place it in a location you will remember<br>
- Double click the zip file which will unzip the contents and make a new folder with YARA inside of it.<br>
Open Command Prompt<br>
- Go to “Start” and type in the search cmd and click on Command Prompt<br>
Navigate to the location just created that has yara64.exe in it using the command prompt.<br>
- cd C:UsersusernameDesktopyara-v3.10.0-904-win64 and hit enter<br>
Linux
There is a lot of flavors of Linux but we will focus on Debian<br>
Prepare your Debian system for Yara by installing the following packages<br>
- sudo apt-get install automake libtool make gcc<br>
Download the source files for [YARA](https://github.com/VirusTotal/yara/archive/v3.10.0.tar.gz)<br>
Run the tar command to untar the files so we can use them to compile<br>
- tar -zxf yara-3.10.0.tar.gz<br>
Change into the directory the source files are located at<br>
- cd yara-3.10.0<br>
Run this command to bootstrap<br>
- ./bootstrap.sh<br>
Run the following commands<br>
- ./configure<br>
- make<br>
- sudo make install<br>
Run the following to make sure everything is running smoothly<br>
- Make check<br>
We are almost to the fun part!! First, we need to make sure that we can run YARA without any errors before moving on. To test you simply type yara or yara64.exe and hit enter. If the following message is displayed on the screen after running the YARA command, you have succeeded with the installation!!!
Usage: yara [OPTION]... [NAMESPACE:]RULES_FILE... FILE | DIR | PID<br>
Try "--help" for more options<br>
Next step will be to create a new Directory/Folder to hold the rules we will be creating. To create one can be done on the command line or by right-clicking on the desktop and create a new folder/file.
Example:
Utilizing the command line/terminal the directory creation looks like this:
$ mkdir yara_rules<br>
$ cd yara_rules/<br>
$ touch master.rules<br>
$ touch name_hunter.rule<br>
No matter what operating system YARA is installed on, we suggest that the rules start as there own file until the rule is completed. Once completed copy and paste the rule and append it inside a “master.rules” file. This file will be where all of the finalized rules for YARA will be housed.
Now that the directory and some of the empty rule files have been created we need a rule to test out what we have set up. The YARA rule template below is a good way to start writing your first rule. Go ahead and copy and paste the template into the name_hunter.rule file just created.
rule yara_base_template : template<br>
{<br>
meta:<br>
author = "name of the rule creator"<br>
description = "This is a template used for yara rules"<br>
creation_date = "2019-06-28"<br>
rule_id = 9000000<br>
version = 1<br>
strings:<br>
$text_string_1 = " "<br>
condition:<br>
any of them<br>
}<br>
/*<br>
This is a place for comments<br>
*/<br>
</code></p>
<p>Once the template is pasted into the name_hunter.rule file we can adjust it to match our name inside of files!!! The below example is filled out a bit more and should be saved once it looks like this.</p>
<p><code>rule my_name_hunter_rule_is_neat : name_hunter<br>
{<br>
meta:<br>
author = "put your name here as you created it"<br>
description = "This rule is for finding my name inside of files using a string match"<br>
creation_date = "2019-06-28"<br>
version = 1<br>
strings:<br>
$name1 = "PutyourNameHere" nocase<br>
condition:<br>
any of them<br>
}<br>
/*<br>
This is the first rule we created and it finds in its current state<br>
Anything that will match PutyourNameHere. We can extend<br>
This and add multiple names by adding more strings like<br>
$name2 = "PutSomeonesNameHere” right under $name1.<br>
The Nocase appended to $name1 means PutyourNameHere is not case sensitive<br>
*/<br>
Next, we will want to make one more file that is not inside of the yara_rules directory/folder and put your name inside of it. The file name can be anything you will remember, so for this use case we used testingfile.txt for testing. Additionally, If you wanted some added fun, copy and paste a lot of random words from an article or another file you may have handy. This will make your name more hidden when we run YARA with the new rule.
The following command is one way how YARA is started in order to carve through files:
Mac<br>
yara -gs /Users/username/Desktop/yara_rules/name_hunter.rule testingfile.txt<br>
Windows<br>
yara64.exe -gs C:UsersusernameDesktopyara_rulesyaraname_hunter.rule testingfile.txt<br>
Linux<br>
yara -gs /Users/username/Desktop/yara_rules/name_hunter.rule testingfile.txt<br>
The following output is using our rule we just created against the testing file and shows that we have a match!!!
yara -gs /Users/username/Desktop/yara_rules/name_hunter.rule testingfile.txt ← command<br>
my_name_hunter_rule_is_neat [name_hunter] testingfile.txt ← rule that matched and file)<br>
0x12d:$name1: PutyourNameHere ← location, string, matched content)<br>
This was a fast way to get everyone up and running in order to get a practical example of what YARA can do. We hope this was an alternative to reading a manual. The next post will provide additional tips and tricks. Play with YARA and happy hunting.
If you’re interested in this kind of work, check out CTO, Pedram Amini’s presentation from Blackhat USA Worm Charming: Harvesting Malware Lures for Fun and Profit .
Free Email Hygiene Analysis
Solid email security begins with proper email hygiene. There are a variety of email hygiene technologies and wrapping one’s head around them all is challenging. Try our complimentary Email Hygiene Analysis and receive an instant report about your company’s security posture including a simple rating with iterative guidance, as well as a comparison against the Fortune 500. Try it today!
