performing-malware-triage-with-yara

使用 YARA 执行恶意软件初筛

何时使用

• 根据已知家族特征快速分类大量恶意软件样本
• 基于独特的字节模式，为最新分析的恶意软件家族编写检测规则
• 扫描文件共享、终端或内存转储，以查找特定威胁的指标
• 构建自动化初筛流水线，在人工分析之前对样本进行分类
• 使用 YARA 扫描在整个企业范围内搜寻已知威胁的变种

请勿将其作为唯一的分析方法；YARA 初筛可识别已知模式，但不会揭示新的或未知的恶意软件行为。

前提条件

• 已安装 YARA 4.x（apt install yara 或 pip install yara-python）
• YARA 规则仓库（YARA-Rules、awesome-yara、Malpedia rules、Florian Roth 的 signature-base）
• Python 3.8+ 及 yara-python，用于脚本化扫描
• 样本收集按目录结构组织，以便批量扫描
• 了解 PE 文件格式、十六进制模式和正则表达式，以便编写规则

工作流

步骤 1：使用现有规则集扫描样本

应用社区和商业 YARA 规则来分类样本：

# Scan a single file
yara -s malware_rules.yar suspect.exe

# Scan a directory of samples
yara -r malware_rules.yar /path/to/samples/

# Scan with multiple rule files
yara -r rules/apt_rules.yar rules/ransomware_rules.yar rules/trojan_rules.yar suspect.exe

# Scan with timeout (prevent hanging on large files)
yara -t 30 malware_rules.yar suspect.exe

# Scan and show matching strings
yara -s -r malware_rules.yar suspect.exe

# Scan with compiled rules (faster for repeated scans)
yarac malware_rules.yar compiled_rules.yarc
yara compiled_rules.yarc suspect.exe

# Download community rule sets
git clone https://github.com/Yara-Rules/rules.git yara-community-rules
git clone https://github.com/Neo23x0/signature-base.git signature-base

# Scan with signature-base
yara -r signature-base/yara/*.yar suspect.exe

步骤 2：为独特字符串模式编写规则

根据恶意软件分析期间提取的字符串创建 YARA 规则：

rule MalwareX_Strings {
    meta:
        description = "Detects MalwareX based on unique strings"
        author = "analyst"
        date = "2025-09-15"
        reference = "Internal Analysis Report #1547"
        hash = "e3b0c44298fc1c149afbf4c8996fb924"
        tlp = "WHITE"

    strings:
        // C2 URL pattern
        $url1 = "/gate.php?id=" ascii
        $url2 = "/panel/connect.php" ascii

        // Unique mutex name
        $mutex = "Global\\CryptLocker_2025" ascii wide

        // User-Agent string
        $ua = "Mozilla/5.0 (compatible; MSIE 10.0)" ascii

        // Registry persistence path
        $reg = "Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsUpdate" ascii

        // Campaign identifier
        $campaign = "campaign_2025_q3" ascii

    condition:
        uint16(0) == 0x5A4D and      // PE file (MZ header)
        filesize < 500KB and          // Size constraint
        ($url1 or $url2) and          // At least one C2 URL
        ($mutex or $campaign) and     // Campaign identifier
        $ua                           // Specific User-Agent
}

步骤 3：为字节模式编写规则

创建匹配特定代码序列的规则：

rule MalwareX_Decryptor {
    meta:
        description = "Detects MalwareX XOR decryption routine"
        author = "analyst"
        date = "2025-09-15"

    strings:
        // XOR decryption loop (x86 assembly)
        // mov al, [esi+ecx]
        // xor al, [edi+ecx]
        // mov [esi+ecx], al
        // inc ecx
        // cmp ecx, edx
        // jl loop
        $xor_loop = { 8A 04 0E 32 04 0F 88 04 0E 41 3B CA 7C F3 }

        // RC4 KSA initialization (256-byte loop)
        $rc4_ksa = { 33 C0 88 04 ?8 40 3D 00 01 00 00 7? }

        // Embedded RSA public key marker
        $rsa_key = { 06 02 00 00 00 A4 00 00 52 53 41 31 }  // PUBLICKEYBLOB

    condition:
        uint16(0) == 0x5A4D and
        ($xor_loop or $rc4_ksa) and
        $rsa_key
}

步骤 4：使用 PE 模块编写规则

利用 YARA 的 PE 模块进行结构化检测：

import "pe"
import "hash"
import "math"

rule MalwareX_PE_Characteristics {
    meta:
        description = "Detects MalwareX by PE structure and imports"
        author = "analyst"

    condition:
        pe.is_pe and

        // Compiled within specific timeframe
        pe.timestamp > 1693526400 and   // After 2023-09-01
        pe.timestamp < 1727740800 and   // Before 2024-10-01

        // Specific import hash
        pe.imphash() == "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6" or

        // Suspicious import combination
        (
            pe.imports("kernel32.dll", "VirtualAllocEx") and
            pe.imports("kernel32.dll", "WriteProcessMemory") and
            pe.imports("kernel32.dll", "CreateRemoteThread") and
            pe.imports("wininet.dll", "InternetOpenA")
        ) or

        // High entropy .text section (packed)
        (
            for any section in pe.sections : (
                section.name == ".text" and
                math.entropy(section.raw_data_offset, section.raw_data_size) > 7.0
            )
        )
}

rule MalwareX_Rich_Header {
    meta:
        description = "Detects MalwareX by Rich header hash"

    condition:
        pe.is_pe and
        hash.md5(pe.rich_signature.clear_data) == "abc123def456abc123def456abc123de"
}

步骤 5：使用 Python 批量初筛

自动化扫描样本集合：

import yara
import os
import json
import hashlib
from datetime import datetime

# Compile all rule files
rule_files = {
    "apt": "rules/apt_rules.yar",
    "ransomware": "rules/ransomware_rules.yar",
    "trojan": "rules/trojan_rules.yar",
    "custom": "rules/custom_rules.yar",
}
rules = yara.compile(filepaths=rule_files)

# Scan sample directory
results = []
sample_dir = "/path/to/samples"

for filename in os.listdir(sample_dir):
    filepath = os.path.join(sample_dir, filename)
    if not os.path.isfile(filepath):
        continue

    with open(filepath, "rb") as f:
        data = f.read()
        sha256 = hashlib.sha256(data).hexdigest()

    matches = rules.match(filepath)

    result = {
        "filename": filename,
        "sha256": sha256,
        "size": len(data),
        "matches": [],
        "classification": "UNKNOWN",
    }

    for match in matches:
        result["matches"].append({
            "rule": match.rule,
            "namespace": match.namespace,
            "tags": match.tags,
            "strings": [(hex(s[0]), s[1], s[2].decode("utf-8", errors="replace")[:100])
                       for s in match.strings] if match.strings else []
        })

    if result["matches"]:
        result["classification"] = result["matches"][0]["namespace"].upper()

    results.append(result)

# Summary
classified = sum(1 for r in results if r["classification"] != "UNKNOWN")
print(f"Scanned: {len(results)} samples")
print(f"Classified: {classified} ({classified/len(results)*100:.1f}%)")
print(f"Unknown: {len(results)-classified}")

# Export results
with open("triage_results.json", "w") as f:
    json.dump(results, f, indent=2)

步骤 6：验证并优化规则

测试规则的误报和性能：

# Test rule syntax
yara -C custom_rules.yar

# Scan known-clean directory to check false positives
yara -r custom_rules.yar /path/to/clean_files/ > false_positives.txt
wc -l false_positives.txt

# Benchmark rule performance
time yara -r custom_rules.yar /path/to/large_sample_collection/

# Profile individual rule performance
yara -p custom_rules.yar suspect.exe

关键概念

术语	定义
YARA 规则	模式匹配规则，定义用于识别特定文件或恶意软件家族的字符串、字节序列和条件
条件	布尔表达式，组合字符串匹配、文件属性和模块函数，以确定规则是否匹配
十六进制字符串	带有可选通配符（??）和跳转（[N-M]）的字节模式，用于匹配机器码或二进制数据
PE 模块	YARA 模块，提供对 PE 文件属性（导入、节、时间戳、资源）的访问，用于结构化匹配
Imphash	PE 文件导入表的 MD5 哈希；同一家族的样本通常共享导入哈希
Rich Header	包含编译器/链接器元数据的未公开 PE 结构；在恶意软件构建环境中保持一致
YARA-C	编译后的 YARA 规则格式，通过预编译规则实现更快的重复扫描

工具与系统

• YARA：模式匹配引擎，用于基于文本、十六进制和结构模式识别和分类恶意软件
• yara-python：YARA 的 Python 绑定，支持脚本化扫描、规则编译及与分析流水线集成
• yarGen：自动 YARA 规则生成器，通过识别独特字符串和操作码从恶意软件样本创建规则
• YARA-Rules（GitHub）：社区维护的 YARA 规则仓库，涵盖恶意软件家族、漏洞利用和可疑指标
• Malpedia YARA：来自 Malpedia 恶意软件百科的精选 YARA 规则，包含高质量的家族特定规则

常见场景

场景：为新的恶意软件家族创建检测规则

背景：对一个新恶意软件样本进行逆向工程后，识别出了独特的字符串、字节模式和 PE 特征。需要编写 YARA 规则，用于全企业范围的威胁搜寻和持续检测。

方法：

1. 从解包后的二进制文件中提取独特字符串（C2 URL、互斥体名称、注册表路径）
2. 从加密例程或 C2 协议中识别独特字节序列（基于 Ghidra 分析）
3. 记录 PE 特征（imphash、Rich 头哈希、节名称、编译时间戳范围）
4. 编写结合字符串、字节模式和 PE 模块条件的 YARA 规则
5. 使用已知恶意软件样本进行测试，确认能够检出真实阳性
6. 使用干净文件语料库（Windows 系统文件、常见应用程序）进行测试，确认误报为零
7. 部署到企业扫描基础设施和威胁情报平台

注意事项：

• 规则针对单个样本编写得过于具体（无法检测只有细微变化的变种）
• 规则编写得过于宽泛（匹配合法软件，导致误报）
• 使用常见库或框架中出现的字符串（例如 OpenSSL 字符串）
• 部署前未在足够庞大的干净语料库上进行测试

输出格式

YARA TRIAGE RESULTS
=====================
Scan Date:        2025-09-15
Rule Sets:        apt_rules (847 rules), ransomware_rules (312 rules),
                  trojan_rules (1,204 rules), custom_rules (45 rules)
Samples Scanned:  2,500
Processing Time:  47 seconds

CLASSIFICATION SUMMARY
APT:              12 samples (0.5%)
Ransomware:       187 samples (7.5%)
Trojan:           423 samples (16.9%)
Unknown:          1,878 samples (75.1%)

TOP MATCHING RULES
Rule                         Matches  Family
MalwareX_C2_Beacon           45       MalwareX
LockBit3_Ransom_Note         38       LockBit 3.0
Emotet_Epoch5_Loader         32       Emotet
CobaltStrike_Beacon_Config   28       Cobalt Strike
QakBot_DLL_Loader            25       QakBot

SAMPLE DETAIL
File:    suspect.exe
SHA-256: e3b0c44298fc1c149afbf4c8996fb924...
Matches:
  [1] MalwareX_Strings (custom)
      - $url1 at 0x4A20: "/gate.php?id="
      - $mutex at 0x5100: "Global\\CryptLocker_2025"
  [2] MalwareX_Decryptor (custom)
      - $xor_loop at 0x401200: { 8A 04 0E 32 04 0F ... }
  [3] MalwareX_PE_Characteristics (custom)
      - PE import combination matched
Classification: MALWAREX (HIGH CONFIDENCE)