security:malware:yara
Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen angezeigt.
| Nächste Überarbeitung | Vorhergehende Überarbeitung | ||
| security:malware:yara [2021/06/19 13:33] – angelegt wikiadm | security:malware:yara [2021/07/03 15:52] (aktuell) – wikiadm | ||
|---|---|---|---|
| Zeile 1: | Zeile 1: | ||
| ====== Create a file on vulnerable Server ====== | ====== Create a file on vulnerable Server ====== | ||
| - | count printable characters with the minimum length of 7 | + | count sequences of printable characters with the minimum length of 7 |
| < | < | ||
| strings --bytes=7 sample.exe | wc -l | strings --bytes=7 sample.exe | wc -l | ||
| Zeile 16: | Zeile 16: | ||
| $s | $s | ||
| } | } | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | sudo yara / | ||
| </ | </ | ||
| Zeile 31: | Zeile 35: | ||
| ====== Rule to detect maleware in PE Files ====== | ====== Rule to detect maleware in PE Files ====== | ||
| + | ===== Generate Rule from Strings ===== | ||
| + | generate_rule.sh | ||
| + | < | ||
| + | #!/bin/bash | ||
| + | |||
| + | echo "rule mw_rule" | ||
| + | echo " | ||
| + | |||
| + | echo " | ||
| + | count=1 | ||
| + | while read s; do | ||
| + | p=${s// | ||
| + | echo " | ||
| + | count=$((count+1)) | ||
| + | done </ | ||
| + | |||
| + | echo "" | ||
| + | |||
| + | echo " | ||
| + | echo " | ||
| + | echo " | ||
| + | echo " | ||
| + | |||
| + | echo " | ||
| + | </ | ||
| + | ===== Final Rule ===== | ||
| malware.yar | malware.yar | ||
| + | --> generated, but left only relevant string | ||
| + | |||
| + | rule mw_rule | ||
| + | { | ||
| + | strings: | ||
| + | $s176 = " | ||
| + | |||
| + | condition: | ||
| + | $s176 and | ||
| + | uint16(0) == 0x5A4D and | ||
| + | uint32(uint32(0x3C)) == 0x4550 | ||
| + | } | ||
| + | |||
| < | < | ||
| - | ... | + | yara / |
| </ | </ | ||
security/malware/yara.1624102404.txt.gz · Zuletzt geändert: von wikiadm