Christian Blichmann
092fc26833
The library built by the Bazel target //sandbox:yara_sapi can be used directly to perform sandboxed YARA scans. The API is intentionally kept very simple, only three methods are exposed by the YaraTransaction C++ class: * YaraTransaction::Create() to create with the specified timeout and number of worker threads * YaraTransaction::LoadRules() to load YARA rules from string, and * YaraTransaction::ScanFd() to scan the contents of a file descriptor. Internally, this creates a new sandboxed sub-process which maintains a dispatch queue and multiple worker threads. The transaction class then multiplexes scan tasks to the sandboxee where they will be executed in parallel. This allows many scan threads to share the same set of YARA rules, saving memory. See sandbox/sandboxed_yara.cc and the unit test in sandbox/yara_transaction_test.cc for examples on how to use this API. Signed-off-by: Christian Blichmann <[email protected]>
YARA in a nutshell
YARA is a tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families (or whatever you want to describe) based on textual or binary patterns. Each description, a.k.a rule, consists of a set of strings and a boolean expression which determine its logic. Let's see an example:
rule silent_banker : banker
{
meta:
description = "This is just an example"
threat_level = 3
in_the_wild = true
strings:
$a = {6A 40 68 00 30 00 00 6A 14 8D 91}
$b = {8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9}
$c = "UVODFRYSIHLNWPEJXQZAKCBGMT"
condition:
$a or $b or $c
}
The above rule is telling YARA that any file containing one of the three strings must be reported as silent_banker. This is just a simple example, more complex and powerful rules can be created by using wild-cards, case-insensitive strings, regular expressions, special operators and many other features that you'll find explained in YARA's documentation.
YARA is multi-platform, running on Windows, Linux and Mac OS X, and can be used through its command-line interface or from your own Python scripts with the yara-python extension.
Additional resources
If you plan to use YARA to scan compressed files (.zip, .tar, etc) you should take a look at yextend, a very helpful extension to YARA developed and open-sourced by Bayshore Networks.
Additionally, the guys from InQuest have curated an awesome list of YARA-related stuff.
Who's using YARA
- ActiveCanopy
- Adlice
- AlienVault
- Avast
- BAE Systems
- Bayshore Networks, Inc.
- BinaryAlert
- Blue Coat
- Blueliv
- Cofense
- Conix
- CrowdStrike FMS
- Cuckoo Sandbox
- Cyber Triage
- Cybereason
- Digita Security
- Dragos Platform
- Dtex Systems
- ESET
- ESTsecurity
- Fidelis XPS
- FireEye, Inc.
- Fox-IT
- FSF
- Guidance Software
- Heroku
- Hornetsecurity
- InQuest
- JASK
- Joe Security
- jsunpack-n
- Kaspersky Lab
- Koodous
- Laika BOSS
- Lastline, Inc.
- LimaCharlie
- McAfee Advanced Threat Defense
- Metaflows
- NBS System
- Nextron Systems
- Nozomi Networks
- osquery
- Payload Security
- PhishMe
- Picus Security
- Radare2
- Raytheon Cyber Products, Inc.
- RedSocks Security
- ReversingLabs
- root9B
- RSA ECAT
- Scanii
- SpamStopsHere
- stoQ
- Symantec
- Tanium
- Tenable Network Security
- The DigiTrust Group
- ThreatConnect
- ThreatStream, Inc.
- Thug
- Trend Micro
- VirusTotal Intelligence
- VMRay
- We Watch Your Website
- Websense
- x64dbg
- YALIH
Are you using it? Want to see your site listed here?