Yara Rule Writing Malware

---
name: yara-rule-writing-malware
description: >
  Write custom YARA rules to identify and classify malware based on textual and binary patterns. 
  This skill focuses on creating robust signatures using strings, regular expressions, and 
  hexadecimal opcodes extracted during malware analysis for enterprise threat hunting.
domain: cybersecurity
subdomain: incident-response
category: Threat Hunting
difficulty: intermediate
estimated_time: "2-3 hours"
mitre_attack:
  tactics: [TA0001, TA0011]
  techniques: [T1059]
platforms: [windows, linux, macos]
tags: [yara, threat-hunting, malware-analysis, static-analysis, signatures, dfir]
tools: [yara, hex-editor, strings]
version: "1.0"
author: CyberSkills-Elite
license: Apache-2.0
---

# YARA Rule Writing for Malware Detection

## When to Use
- When performing incident response and you need to scan the entire environment for indicators of compromise (IoCs) related to a specific malware family.
- After extracting unique string patterns, mutexes, paths, or code blocks from a malware sample during static/dynamic analysis.


## Prerequisites
- Authorized scope and rules of engagement for the target environment
- Appropriate tools installed on the attack/analysis platform
- Understanding of the target technology stack and architecture
- Documentation template ready for findings and evidence capture

## Workflow

### Phase 1: Understanding Basic YARA Structure

```yara
# Concept: Rule syntax rule Basic_Ransomware_Detection {
    meta:
        description = "Detects generic ransomware strings"
        author = "CyberSkills"
        date = "2024-05-10"
    
    strings:
        $s1 = "Your files have been encrypted" ascii wide nocase
        $s2 = "比特币" // Bitcoin in Chinese (UTF-8)
        $s3 = "vssadmin.exe Delete Shadows /All /Quiet" ascii wide
        
    condition:
        2 of them
}
```

### Phase 2: Utilizing Hexadecimal Signatures

```yara
# rule Emotet_Hex_Pattern {
    meta:
        description = "Detects Emotet unpacking loop pattern"

    strings:
        // 8B 45 ?? 03 45 ?? 50 FF 15
        $hex_pattern = { 8B 45 ?? 03 45 ?? 50 FF 15 [4] }
        
    condition:
        $hex_pattern
}
```

### Phase 3: Leveraging the PE Module (Windows Executables)

```yara
# import module import "pe"

rule Suspicious_Document_Icon {
    meta:
        description = "Executable disguised as PDF/Word doc"
        
    condition:
        uint16(0) == 0x5a4d and // MZ header
        pe.number_of_resources > 0 and 
        (
            pe.version_info["OriginalFilename"] contains ".pdf" or
            pe.version_info["OriginalFilename"] contains ".docx"
        )
}
```

### Phase 4: Validating and Executing the Scan

```bash
# yara -r my_rules.yar /path/to/suspicious/files/
```

#### Decision Point 🔀
```mermaid
flowchart TD
    A[Extract Strings ] --> B{Are Strings Unique? }
    B -->|Yes| C[Create String Rule ]
    B -->|No| D[Extract Hex/Opcodes ]
    C --> E[Test Rule Avoid FPs ]
```

## 🔵 Blue Team Detection & Defense
- **Continuous Integration for Rules**: **Avoid False Positives**: **Performance Tuning**: Key Concepts
| Concept | Description |
|---------|-------------|
## Output Format
```
Yara Rule Writing Malware — Assessment Report
============================================================
Target: [Target identifier]
Assessor: [Operator name]
Date: [Assessment date]
Scope: [Authorized scope]
MITRE ATT&CK: [Relevant technique IDs]

Findings Summary:
  [Finding 1]: [Severity] — [Brief description]
  [Finding 2]: [Severity] — [Brief description]

Detailed Results:
  Phase 1: [Phase name]
    - Result: [Outcome]
    - Evidence: [Screenshot/log reference]
    - Impact: [Business impact assessment]

  Phase 2: [Phase name]
    - Result: [Outcome]
    - Evidence: [Screenshot/log reference]
    - Impact: [Business impact assessment]

Risk Rating: [Critical/High/Medium/Low/Informational]
Recommendations:
  1. [Immediate remediation step]
  2. [Long-term hardening measure]
  3. [Monitoring/detection improvement]
```


## 📚 Shared Resources
> For cross-cutting methodology applicable to all vulnerability classes, see:
> - [`_shared/references/elite-chaining-strategy.md`](../_shared/references/elite-chaining-strategy.md) — Exploit chaining methodology and high-payout chain patterns
> - [`_shared/references/elite-report-writing.md`](../_shared/references/elite-report-writing.md) — HackerOne-optimized report writing, CWE quick reference
> - [`_shared/references/real-world-bounties.md`](../_shared/references/real-world-bounties.md) — Verified disclosed bounties by vulnerability class

## References
- YARA Documentation: [Writing YARA rules](https://yara.readthedocs.io/en/stable/writingrules.html)
- Kaspersky: [YARA Rule Writing Tips](https://securelist.com/yara-rules/86170/)