YARA language preview

1. A suspicious executable rule

meta, strings, and condition sections

horizon-dark

import "pe"

rule SuspiciousExecutable : malware
{
    meta:
        author = "analyst"
        threat = "trojan"

    strings:
        $a = "malicious_string" nocase
        $hex = { E2 34 ?? C8 }
        $re = /evil[0-9]+/i

    condition:
        uint16(0) == 0x5A4D and $a and $hex and pe.number_of_sections > 3
}

atom-one-dark

import "pe"

rule SuspiciousExecutable : malware
{
    meta:
        author = "analyst"
        threat = "trojan"

    strings:
        $a = "malicious_string" nocase
        $hex = { E2 34 ?? C8 }
        $re = /evil[0-9]+/i

    condition:
        uint16(0) == 0x5A4D and $a and $hex and pe.number_of_sections > 3
}

github-dark

import "pe"

rule SuspiciousExecutable : malware
{
    meta:
        author = "analyst"
        threat = "trojan"

    strings:
        $a = "malicious_string" nocase
        $hex = { E2 34 ?? C8 }
        $re = /evil[0-9]+/i

    condition:
        uint16(0) == 0x5A4D and $a and $hex and pe.number_of_sections > 3
}

dracula

import "pe"

rule SuspiciousExecutable : malware
{
    meta:
        author = "analyst"
        threat = "trojan"

    strings:
        $a = "malicious_string" nocase
        $hex = { E2 34 ?? C8 }
        $re = /evil[0-9]+/i

    condition:
        uint16(0) == 0x5A4D and $a and $hex and pe.number_of_sections > 3
}

nord

import "pe"

rule SuspiciousExecutable : malware
{
    meta:
        author = "analyst"
        threat = "trojan"

    strings:
        $a = "malicious_string" nocase
        $hex = { E2 34 ?? C8 }
        $re = /evil[0-9]+/i

    condition:
        uint16(0) == 0x5A4D and $a and $hex and pe.number_of_sections > 3
}

github

import "pe"

rule SuspiciousExecutable : malware
{
    meta:
        author = "analyst"
        threat = "trojan"

    strings:
        $a = "malicious_string" nocase
        $hex = { E2 34 ?? C8 }
        $re = /evil[0-9]+/i

    condition:
        uint16(0) == 0x5A4D and $a and $hex and pe.number_of_sections > 3
}

2. String counts and offsets

#, @, and ! string reference operators

horizon-dark

rule Repeated
{
    strings:
        $a = "AA"

    condition:
        #a > 3 and @a[1] < 100 and !a > 10
}

atom-one-dark

rule Repeated
{
    strings:
        $a = "AA"

    condition:
        #a > 3 and @a[1] < 100 and !a > 10
}

github-dark

rule Repeated
{
    strings:
        $a = "AA"

    condition:
        #a > 3 and @a[1] < 100 and !a > 10
}

dracula

rule Repeated
{
    strings:
        $a = "AA"

    condition:
        #a > 3 and @a[1] < 100 and !a > 10
}

nord

rule Repeated
{
    strings:
        $a = "AA"

    condition:
        #a > 3 and @a[1] < 100 and !a > 10
}

github

rule Repeated
{
    strings:
        $a = "AA"

    condition:
        #a > 3 and @a[1] < 100 and !a > 10
}

3. Module functions

the hash and math built-in modules

horizon-dark

import "hash"
import "math"

rule HighEntropy
{
    condition:
        math.entropy(0, filesize) > 7.0 and
        hash.md5(0, filesize) != ""
}

atom-one-dark

import "hash"
import "math"

rule HighEntropy
{
    condition:
        math.entropy(0, filesize) > 7.0 and
        hash.md5(0, filesize) != ""
}

github-dark

import "hash"
import "math"

rule HighEntropy
{
    condition:
        math.entropy(0, filesize) > 7.0 and
        hash.md5(0, filesize) != ""
}

dracula

import "hash"
import "math"

rule HighEntropy
{
    condition:
        math.entropy(0, filesize) > 7.0 and
        hash.md5(0, filesize) != ""
}

nord

import "hash"
import "math"

rule HighEntropy
{
    condition:
        math.entropy(0, filesize) > 7.0 and
        hash.md5(0, filesize) != ""
}

github

import "hash"
import "math"

rule HighEntropy
{
    condition:
        math.entropy(0, filesize) > 7.0 and
        hash.md5(0, filesize) != ""
}