wxsBSD

With the release of YARA 3.2.0 I wanted to show people how to utilize some of the new features. In particular I'll show an example for rich_signatures, import hashing and Authenticode signatures.

You'll need both of these for obvious reasons. :)

import "pe"
import "hash"

wxsBSD

Introduction

I'd like to explain some of the new things I've added to YARA which will be in the next release. This is in addition to the stuff I've written about here, which are already in 3.2.0. If you have not read that I suggest you start there as it will tie in nicely with some of the things I'm going to mention here. Lastly, some of these things are not yet merged into master but I expect them to be very soon.

Math Module

There is a new module in YARA called math. The intention of this module is to expose some functions which you can use in your rules to calculate specific properties.

Functions

In particular it provides these functions for calculating different values:

• entropy

wxsBSD

Someone recently asked me if it is possible to test if a string is in a section or not in YARA. This is my attempt at an answer, and please note that some of the capabilities are still pending a merge to master.

// Make sure the string is in the .rsrc section.
rule test_in {
  strings:
    $a = { DE AD BE EF 00 00 DE AD BE EF }
  condition:
    $a in ((pe.sections[pe.section_index(".rsrc")].raw_data_offset)..(pe.sections[pe.section_index(".rsrc")].raw_data_offset + pe.sections[pe.section_index(".rsrc")].raw_data_size))
}

wxsBSD

Problems with pehash implementations

I've started to add a pehash implementation to YARA. I decided to base my implementation on the description in the paper and only use the totalhash and viper implementations for comparing results. In doing so I've noticed some problems, and it is unclear who is right.

Totalhash implementation

For starters let's take a look at running the pehash.py implementation from totalhash against a binary.

wxs@psh Desktop % shasum 4180ee367740c271e05b3637ee64619fb9fe7b1d2b28866e590e731b9f81de36

wxsBSD

Here's what I was thinking of doing...

{
  // Description of the YARA rules to use. Each key is a group name used in additional_monitoring
  // or in scheduled_queries if you want.
  "yara": {
    "sig_group_1": [ "foo.sig", "bar.sig" ],
    "sig_group_2": [ "baz.sig" ]
  },

wxsBSD

I was recently asked how to check the entropy of a given section in YARA, and because the person who asked is clearly looking to learn how to fish instead of just being given fish I went into some detail on the explanation. With his permission I am sharing my response here.

It's a combination of a number of things:

math.in_range(test, lower, upper):

Given a test value, check to see if it is in range of the lower and upper bounds. This is an inclusive test.

math.entropy(offset, length):

wxsBSD

Note

This is outdated. The canonical source of documentation on this is over here.

Introduction

I recently put YARA inside osquery and thought I would provide some details on how to use it. There are two YARA related tables in osquery, which serve very different purposes. The first table, called yara_events, uses osquery's pub-sub framework to monitor for filesystem changes and will execute YARA when a file change event fires. The second table, called yara, is an on-demand YARA scanning table.

Configuration

wxsBSD

Disclaimer

Everything I'm talking about below is not new, but I thought it was an interesting idea and realized I already had the majority of pieces in place to play with it. I want to share what I learned. If you are at all interested in exploring this topic further a good paper on it is here. Also, a few years ago IOActive published a blog post on the technique which is also a good read. Finally, the last two paragraphs in section 6 of RFC5246 clearly document the problem the best I've been able to find:

Any protocol designed for use over TLS must be carefully designed to
deal with all possible attacks against it.  As a practical matter,
this means that the protocol designer must be aware of what security
properties TLS does and does not provide and cannot safely rely on
the latter.

wxsBSD

SSL Profiling in Bro

I wrote profiling applications over SSL recently and this is my attempt at doing so in Bro. I haven't written a Bro script before this one so I'm betting I've got a bunch of things wrong here. The code comes in two parts. The first is the main script which has the core logic. The second part is the "local" script which defines the application profiles you are interested in.

The Main Script

@load base/protocols/conn
@load base/protocols/ssl
@load base/frameworks/notice

wxsBSD

Using YARA python interface to parse files

I've shared this technique with some people privately, but might as well share it publicly now since I was asked about it. I've been using this for a while now with good success. It works well for parsing .NET droppers and other things.

If you don't know what the -D flag to YARA does I suggest you import a module and run a file through using that flag. It will print, to stdout, everything the module parsed that doesn't involve you calling a function. This is a great way to get a quick idea for the structure of a file.

For example:

wxs@mbp yara % cat always_false.yara