Skip to content

Commit 6645519

Browse files
egibsegibs
committed
Use the include directive to centralize common private rules
Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>
1 parent 4236ea3 commit 6645519

44 files changed

Lines changed: 436 additions & 569 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎rules/anti-behavior/random_behavior.yara‎

Lines changed: 3 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,6 @@
1-
import "math"
2-
3-
private rule random_behavior_pythonSetup {
4-
strings:
5-
$if_distutils = /from distutils.core import .{0,32}setup/
6-
$if_setuptools = /from setuptools import .{0,32}setup/
7-
$i_setuptools = "import setuptools"
8-
$setup = "setup("
9-
10-
$not_setup_example = ">>> setup("
11-
$not_setup_todict = "setup(**config.todict()"
12-
$not_import_quoted = "\"from setuptools import setup"
13-
$not_setup_quoted = "\"setup(name="
14-
$not_distutils = "from distutils.errors import"
1+
include "rules/global/global.yara"
152

16-
condition:
17-
filesize < 128KB and $setup and any of ($i*) and none of ($not*)
18-
}
3+
import "math"
194

205
rule setuptools_random: critical {
216
meta:
@@ -27,7 +12,7 @@ rule setuptools_random: critical {
2712
$not_easy_install = "pid = random.randint(0, sys.maxsize)"
2813
2914
condition:
30-
random_behavior_pythonSetup and $ref and none of ($not*)
15+
python_setup and $ref and none of ($not*)
3116
}
3217

3318
rule java_random: low {

‎rules/anti-static/elf/entropy.yara‎

Lines changed: 2 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,6 @@
1-
import "math"
2-
3-
private rule normal_elf {
4-
condition:
5-
filesize < 64MB and uint32(0) == 1179403647
6-
}
1+
include "rules/global/global.yara"
72

8-
private rule small_elf {
9-
condition:
10-
filesize < 400KB and uint32(0) == 1179403647
11-
}
3+
import "math"
124

135
rule higher_elf_entropy_68: medium {
146
meta:

‎rules/anti-static/macho/entropy.yara‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,14 @@
1-
import "math"
1+
include "rules/global/global.yara"
22

3-
private rule smaller_macho {
4-
condition:
5-
filesize < 64MB and (uint32(0) == 4277009102 or uint32(0) == 3472551422 or uint32(0) == 4277009103 or uint32(0) == 3489328638 or uint32(0) == 3405691582 or uint32(0) == 3199925962)
6-
}
3+
import "math"
74

85
rule higher_entropy_6_9: medium {
96
meta:
107
description = "higher entropy binary (>6.9)"
118
filetypes = "macho"
129

1310
condition:
14-
smaller_macho and math.entropy(1, filesize) >= 6.9
11+
small_macho and math.entropy(1, filesize) >= 6.9
1512
}
1613

1714
rule high_entropy_7_2: high {
@@ -24,5 +21,5 @@ rule high_entropy_7_2: high {
2421
$bin_java = "bin/java"
2522
2623
condition:
27-
smaller_macho and math.entropy(1, filesize) >= 7.2 and not $bin_java
24+
small_macho and math.entropy(1, filesize) >= 7.2 and not $bin_java
2825
}

‎rules/anti-static/macho/footer.yara‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,6 @@
1-
import "math"
1+
include "rules/global/global.yara"
22

3-
private rule anti_static_macho {
4-
condition:
5-
(uint32(0) == 4277009102 or uint32(0) == 3472551422 or uint32(0) == 4277009103 or uint32(0) == 3489328638 or uint32(0) == 3405691582 or uint32(0) == 3199925962 or uint32(0) == 3405691583 or uint32(0) == 3216703178)
6-
}
3+
import "math"
74

85
rule high_entropy_trailer: high {
96
meta:
@@ -15,5 +12,5 @@ rule high_entropy_trailer: high {
1512
$page_zero = "_PAGEZERO"
1613
1714
condition:
18-
filesize < 10MB and anti_static_macho and $page_zero and math.entropy(filesize - 1024, filesize - 1) >= 4
15+
filesize < 10MB and macho and $page_zero and math.entropy(filesize - 1024, filesize - 1) >= 4
1916
}

‎rules/anti-static/packer/aes.yara‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,6 @@
1-
import "math"
1+
include "rules/global/global.yara"
22

3-
private rule smallBinary {
4-
condition:
5-
// matches ELF or machO binary
6-
filesize > 1MB and filesize < 8MB and (uint32(0) == 1179403647 or uint32(0) == 4277009102 or uint32(0) == 3472551422 or uint32(0) == 4277009103 or uint32(0) == 3489328638 or uint32(0) == 3405691582 or uint32(0) == 3199925962)
7-
}
3+
import "math"
84

95
rule go_aes: high {
106
meta:
@@ -17,5 +13,5 @@ rule go_aes: high {
1713
$decrypt = "NewCFBDecrypter"
1814
1915
condition:
20-
smallBinary and math.entropy(1, filesize) >= 7 and all of them
16+
small_binary and math.entropy(1, filesize) >= 7 and all of them
2117
}

‎rules/anti-static/unmarshal/marshal.yara‎

Lines changed: 3 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,6 @@
1-
import "math"
2-
3-
private rule pySetup {
4-
strings:
5-
$i_distutils = "from distutils.core import setup"
6-
$i_setuptools = "setuptools"
7-
$setup = "setup("
8-
$not_setuptools = "setuptools.command"
1+
include "rules/global/global.yara"
92

10-
condition:
11-
filesize < 2097152 and $setup and any of ($i*) and none of ($not*)
12-
}
3+
import "math"
134

145
rule unmarshal_py_marshal: medium {
156
meta:
@@ -29,5 +20,5 @@ rule setuptools_py_marshal: suspicious {
2920
filetypes = "py"
3021

3122
condition:
32-
pySetup and unmarshal_py_marshal
23+
python_setup and unmarshal_py_marshal
3324
}

‎rules/c2/addr/ip.yara‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
include "rules/global/global.yara"
2+
13
rule hardcoded_ip: medium {
24
meta:
35
description = "hardcoded IP address"
@@ -19,11 +21,6 @@ rule hardcoded_ip: medium {
1921
filesize < 200MB and 1 of ($sus_ip*) and none of ($not*)
2022
}
2123

22-
private rule ip_elf_or_macho {
23-
condition:
24-
uint32(0) == 1179403647 or (uint32(0) == 4277009102 or uint32(0) == 3472551422 or uint32(0) == 4277009103 or uint32(0) == 3489328638 or uint32(0) == 3405691582 or uint32(0) == 3199925962 or uint32(0) == 3405691583 or uint32(0) == 3216703178)
25-
}
26-
2724
rule bin_hardcoded_ip: high {
2825
meta:
2926
description = "ELF with hardcoded IP address"
@@ -48,7 +45,7 @@ rule bin_hardcoded_ip: high {
4845
$not_2345 = "23.45.67.89"
4946
5047
condition:
51-
filesize < 12MB and ip_elf_or_macho and 1 of ($sus_ip*) and none of ($not*)
48+
filesize < 12MB and elf_or_macho and 1 of ($sus_ip*) and none of ($not*)
5249
}
5350

5451
rule http_hardcoded_ip: high exfil {

‎rules/c2/addr/url.yara‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,6 @@
1-
import "math"
1+
include "rules/global/global.yara"
22

3-
private rule elf_or_macho {
4-
condition:
5-
uint32(0) == 1179403647 or (uint32(0) == 4277009102 or uint32(0) == 3472551422 or uint32(0) == 4277009103 or uint32(0) == 3489328638 or uint32(0) == 3405691582 or uint32(0) == 3199925962 or uint32(0) == 3405691583 or uint32(0) == 3216703178)
6-
}
3+
import "math"
74

85
rule unusual_nodename: medium {
96
meta:

‎rules/c2/tool_transfer/download.yara‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
include "rules/global/global.yara"
2+
13
rule download_sites: high {
24
meta:
35
ref = "https://github.com/ditekshen/detection/blob/e6579590779f62cbe7f5e14b5be7d77b2280f516/yara/indicator_high.yar#L1001"
@@ -113,12 +115,6 @@ rule http_archive_url: medium {
113115
any of ($ref*) and none of ($not*)
114116
}
115117

116-
private rule smallerBinary {
117-
condition:
118-
// matches ELF or machO binary
119-
filesize < 10MB and (uint32(0) == 1179403647 or uint32(0) == 4277009102 or uint32(0) == 3472551422 or uint32(0) == 4277009103 or uint32(0) == 3489328638 or uint32(0) == 3405691582 or uint32(0) == 3199925962)
120-
}
121-
122118
rule http_archive_url_higher: high {
123119
meta:
124120
description = "accesses hardcoded archive file endpoint"
@@ -129,5 +125,5 @@ rule http_archive_url_higher: high {
129125
$not_foo_bar = "http://foo/bar.tar"
130126
131127
condition:
132-
smallerBinary and any of ($ref*) and none of ($not*)
128+
small_binary and any of ($ref*) and none of ($not*)
133129
}

‎rules/c2/tool_transfer/macos.yara‎

Lines changed: 2 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,4 @@
1-
private rule tool_transfer_macho {
2-
strings:
3-
$not_jar = "META-INF/"
4-
$not_dwarf = "_DWARF"
5-
$not_kext = "_.SYMDEF SORTED"
6-
7-
condition:
8-
(uint32(0) == 4277009102 or uint32(0) == 3472551422 or uint32(0) == 4277009103 or uint32(0) == 3489328638 or uint32(0) == 3405691582 or uint32(0) == 3199925962 or uint32(0) == 3405691583 or uint32(0) == 3216703178) and none of ($not*)
9-
}
1+
include "rules/global/global.yara"
102

113
rule macos_chflags_hidden: critical {
124
meta:
@@ -38,5 +30,5 @@ rule cocoa_bundle_dropper: critical {
3830
$platform = "isPlatformOrVariantPlatformVersionAtLeast" fullword
3931
4032
condition:
41-
tool_transfer_macho and $shared and 5 of them
33+
specific_macho and $shared and 5 of them
4234
}

0 commit comments

Comments
 (0)