100 Days of YARA

100DaysOfYARA.yar

import "pe"
import "hash"
import "math"

rule packedTextSection {
    meta:
        description = " Look for high-entropy .text sections within PE files "
        author = "Droogy"
        DaysOfYARA = "3/100"

    condition:
        for any section in pe.sections: (
            section.name == ".text"    // .text section contains executable code likely to be packed
        )
        and
        for any section in pe.sections: (
            math.entropy(
                section.raw_data_offset, 
                section.raw_data_size
            ) >= 7    // entropy goes from 0-8, generally 6.5 and above is high
        )
}

rule isDotNet {
    meta:
        description = " Detect if file is .NET assembly "
        author = "Droogy"
        DaysOfYARA = "2/100"

    condition:
        pe.number_of_sections >= 3
        and
        pe.imports(/mscoree.dll/i, /_CorExeMain/ ) == 1
}

rule solitaire {
    meta:
        description = " Suspicious file pulled from malshare named Solitaire.exe - has no hits on VT"
        author = "Droogy"
        DaysOfYARA = "1/100"
    
    condition:
        uint16(0) == 0x5a4d
        and
        pe.number_of_sections == 7 
        and
        for any var_section in pe.sections: (
            var_section.name == "_RDATA"    // clue this is a cpp file compiled in VS
        )
}