Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Leverage yr scan --profile to tune slowest rules #708

Merged
merged 7 commits into from
Dec 16, 2024
Merged

Leverage yr scan --profile to tune slowest rules #708

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
d08c187
Leverage yr scan --profile to tune slowest rules
egibs Dec 16, 2024
6af3505
Ignore compiled rules
egibs Dec 16, 2024
477b283
Run make yara-x-fmt
egibs Dec 16, 2024
5ed3568
Address PR comments
egibs Dec 16, 2024
f4a7735
Merge b64decode + long_str strings
egibs Dec 16, 2024
39d5750
Run make yara-x-fmt
egibs Dec 16, 2024
a9f7b83
Merge branch 'main' into yara-x-profiling-findings
egibs Dec 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,3 +29,6 @@ profiles/

# Malcontent samples (obsolete)
samples/

# Compiled rules
*.yarc
25 changes: 12 additions & 13 deletions rules/anti-static/obfuscation/python.yara
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -440,19 +440,18 @@ rule decompress_base64_entropy: high {
description = "hidden base64-encoded compressed content"

strings:
$k_lzma = "lzma"
$k_gzip = "gzip"
$k_zlib = "zlib"
$b64decode = "b64decode("
$f_bytes = "bytes("
$f_decode = "decode("
$f_decompress = "decompress("
$f_eval = "eval("
$f_exec = "exec("
$long_str = /[\'\"][\+\w\/]{96}/

condition:
filesize < 10MB and any of ($k*) and $b64decode and $long_str and any of ($f*)
$k_lzma = "lzma"
$k_gzip = "gzip"
$k_zlib = "zlib"
$f_bytes = "bytes("
$f_decode = "decode("
$f_decompress = "decompress("
$f_eval = "eval("
$f_exec = "exec("
$b64decode_long = /b64decode\(\"[\+\=\w\/]{96}/
tstromberg marked this conversation as resolved.
Show resolved Hide resolved

condition:
filesize < 10MB and any of ($k*) and $b64decode_long and any of ($f*)
}

rule join: low {
Expand Down
5 changes: 2 additions & 3 deletions rules/c2/tool_transfer/download.yara
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,7 +75,7 @@ rule http_archive_url: medium {
description = "accesses hardcoded archive file endpoint"

strings:
$ref = /https*:\/\/[\w\.]{0,160}[:\/\w\_\-\?\@=]{6,160}\.(zip|tar|tgz|gz|xz)/ fullword
$ref = /https{0,1}:\/\/[\w\.]{0,160}[:\/\w\_\-\?\@=]{6,160}\.(zip|tar|tgz|gz|xz)/ fullword
$not_foo_bar = "http://foo/bar.tar"

condition:
Expand All @@ -93,10 +93,9 @@ rule http_archive_url_higher: high {
description = "accesses hardcoded archive file endpoint"

strings:
$ref = /https*:\/\/[\w\.]{0,160}[:\/\w\_\-\?\@=]{6,160}\.(zip|tar|tgz|gz|xz)/ fullword
$ref = /https{0,1}:\/\/[\w\.]{0,160}[:\/\w\_\-\?\@=]{6,160}\.(zip|tar|tgz|gz|xz)/ fullword
$not_foo_bar = "http://foo/bar.tar"

condition:
smallerBinary and any of ($ref*) and none of ($not*)
}

5 changes: 2 additions & 3 deletions rules/impact/degrade/app.yara
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ rule osascript_window_closer: medium {
$c_osascript = "osascript" fullword
$c_tell = "tell" fullword
$c_application = "application" fullword
$c_app_name = /\"\w[\.\w ]{0,24}\w\"/ fullword
$c_app_name = /\"\w[\.\w]{3,24}\w\"/ fullword
$c_to = "to" fullword
$c_close = "close" fullword
$c_window = "window" fullword
Expand All @@ -23,11 +23,10 @@ rule osascript_quitter: medium {
$c_osascript = "osascript" fullword
$c_tell = "tell" fullword
$c_application = "application" fullword
$c_app_name = /\"\w[\.\w ]{0,24}\w\"/ fullword
$c_app_name = /\"\w[\.\w]{3,24}\w\"/ fullword
$c_to = "to" fullword
$c_quit = "quit" fullword

condition:
filesize < 256KB and all of ($c*)
}

Loading