https://github.com/VirusTotal/yara
Basis
yara myRule.yar /some/fileExecute Yara rule on a file: search for a pattern in the file.
Flag
-mPrints metadata of the rules that were satisfied during the analysis.
-cPrints the number of matches.
-sPrints satisfied rules.
-nPrints not satisfied rules.
Rules
Cheat Sheet: https://twitter.com/fr0gger_/status/1516570364775907328/photo/1
Keywords: and, not, or, >, >=, !=, any of them
Example:
rule myRule {
/* Infos */
meta:
author = "myAuthor"
description = "myRule Description"
created = "12/12/2012 12:12"
/* Match one string */
strings:
$myString = “Hello myString”
condition:
$myString
/* Match multiple strings */
strings:
$myStringLow = “hello mystring”
$myStringHigh = “HELLO MYSTRING”
condition:
any of them
}
Valhalla Rules Database: https://valhalla.nextron-systems.com/
YarGen
https://github.com/Neo23x0/yarGen
python3 yarGen.py --updateUpdate.
python3 yarGen.py -m mySuspiciousFile --excludegood -o myNewRule.yarCreate a Yara rule from mySuspiciousFile.
-mPath to the files you want to generate rules for.
--excludegoodForce to exclude all goodware strings.
-oOutput Yara rule file.