YaraTips

Occasional tips for writing #Yara rules (DM or Tweet suggestions)

[YaraTips @YaraTips]

@pmelson Scan found only the AIX files.

[YaraTips @YaraTips]

Nice use of file-header matching in the FastCash rules form @pmelson:
https://t.co/kDuXQXKihM
https://t.co/ZdIUztUqPM

[Florian Roth ⚡️ @cyb3rops]

50 Shades of YARA
> an overview of the different rule types
> reasons why there is no single best #YARA rule for the detection of a certain malware/tool
https://t.co/vvficebfuy

[YaraTips @YaraTips]

@James_inthe_box @bry_campbell "C:\Users\Admin\Documents\Visual Studio 2015\Projects From Ryuk\ConsoleApplication54\x64\Release\ConsoleApplication54.pdb"

[YaraTips @YaraTips]

@James_inthe_box @bry_campbell You could also add a conditional string (or a separate rule) to match on the build path:

[YaraTips @YaraTips]

Tool from @PunchCyber to manage rulesets https://t.co/FHfUA2NjfQ

[YaraTips @YaraTips]

@_Stahlz

[YaraTips @YaraTips]

@wxs Or jump on Keybase ;)

[YaraTips @YaraTips]

@wxs Sure, However, in the cases where I find myself getting this error, it's often because of unbounded regular expressions or too short strings. The later most often leads to false-positives

[YaraTips @YaraTips]

@wxs Will DM

[YaraTips @YaraTips]

@wxs Absolutely. Yara warnings should be addressed before the rule is published (just like readability / style requirements / etc). My general rule of thumb is if it triggers a warning, it'll trigger false-positives.

[YaraTips @YaraTips]

Don't ignore the native warnings. if Yara is telling you a string is slowing down scanning - fix it before you put it into production

[YaraTips @YaraTips]

@wxs I've also found the dotnet module is fairly expensive.

[YaraTips @YaraTips]

@wxs Interesting. In the case, using things like uint16(0) == 0x5A4D won't really help with performance because it is a check condition check and handled post string searching.

[YaraTips @YaraTips]

@wxs

[YaraTips @YaraTips]

@wxs Thanks @wxs

[YaraTips @YaraTips]

Also - if you are using Git to manage your ruleset, you write a post-commit hook to automatically sync the results to VT Hunting

[YaraTips @YaraTips]

Using your Yara rules with @virustotal? You can now create/change/delete using the API - https://t.co/mIQG7Vcf8M

[YaraTips @YaraTips]

Setting a global rule to restrict scanning files over n-MB or by file-type by using uint16(0) == 0x5A4D (for PE files)? Yara will still scan the file, however, it will not optimize the scan performance (#Malware / #MalwareAnalsis) (Thanks @wxs )

[YaraTips @YaraTips]

Optimizing Yara rules https://t.co/Nt0lMPXLWJ