Advanced YARA Techniques

Beyond string matching, YARA modules provide structured access to file formats. The PE module analyzes Windows executables. Other modules handle ELF, Mach-O, and encrypted/obfuscated content.

PE Module

The PE module parses Windows executable structure:

import "pe"

rule suspicious_packer {
condition:
pe.number_of_sections < 3 and
pe.entry_point > pe.sections[0].raw_data_size
}

Common PE module features:

pe.number_of_sections - Section count (few sections may indicate packing)
pe.entry_point - Entry point offset
pe.sections - Array of sections with name, characteristics, size
pe.imports - Imported functions by DLL
pe.exports - Exported functions
pe.signatures - Digital signature information

Hunting for Malware Families

Family-specific rules target known characteristics:

rule emotet_loader {
meta:
description = "Detects Emotet loader"
family = "Emotet"
strings:
$enc_routine = { 8B ?? 24 ?? 35 ?? ?? ?? ?? 89 }
$api_hash = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 }
$string1 = "Microsoft\Windows"
condition:
uint16(0) == 0x5A4D and
($enc_routine or $api_hash) and
$string1
}

Combine:

• Structural indicators (file format checks)


• Behavioral strings (API references, paths)


• Code patterns (encryption routines, hashing)

Rule Sets and Hunting

Organize rules into sets by purpose:

• Detection rules - High confidence, low false positives, for automated alerting


• Hunting rules - Broader matching, acceptable false positives, for investigation


• Classification rules - Categorize samples into families or types

Hunting rules help discover new variants. Accept some false positives in exchange for catching variations the specific detection rules miss.

Testing and Maintenance

yarGen generates rules from sample sets automatically, extracting unique strings.

yaraQA validates rules and checks for common errors.

Test against goodware. A rule matching Windows system files produces constant false positives. Build test sets of legitimate files to verify clean scan.

Update rules as malware evolves. Version control tracks changes. Review threat intelligence for new variants requiring rule updates.