One of VirusTotal’s biggest strengths is its Hunting capabilities using YARA rules. In addition to matching all files against a big set of crowdsourced YARA rules, it also allows users to create their own detection and classification rules.
YARA was originally intended to support file-based rules. VirusTotal’s
“vt” module extended YARA’s capabilities with file’s metadata and behavior. This allows our users to create advanced
Livehunt and
Retrohunt rules and get notified via
IoC Stream every time
new or
re-scanned files match our rules.
Designing good YARA rules requires some level of expertise and time investment. That’s why we have reengineered our built-in YARA editor to make it easier for our users to create, test and deploy rules. In this post we will provide details for all its new capabilities!
Other than making YARAs look glorious with full syntax coloring and auto-complete, there is much more this editor offers. But first let’s clarify how to find the new editor.
The new YARA editor can be accessed from the
Livehunt or
Retrohunt dashboards over the
Hunting dropdown on the top left menu of the landing page. From the Livehunt dashboard, the
“New Livehunt Ruleset” dropdown has 4 options that link you to the YARA editor for the specific entity of your interest.
This post will focus on file rules – but stay tuned for future posts detailing all other options.
Ok, now let’s see in more detail all the big new features!
Feature #1 – YARA rule templates
The YARA editor provides you with pre-defined self-descriptive
rule templates (
here you can find full details). We will keep adding more templates in the future and refreshing existing ones.
For instance, let’s say that you are interested in new samples, detected as malicious by AntiVirus engines, and hosted on a certain domain or URL. You can filter out templates available using keywords such as: “URL”, “download” and “positive”, and select the one that fits you better based on its description, as shown in the image below.
Now it’s easier to build your own rules by making use of the suggested templates. You just need to replace the placeholders with your specifics. Additionally, it is very important to rename the predefined rules so you can easily identify the source of the notifications you’ll receive in your
IoC Stream. In this case, the target URL and the number of detections for new files.
We will create a new rule based on these templates, with a few extra details: [1] we want to get PDF files only, [2] check if the file was seen hosted in a given domain, and [3] add a couple of extra domains to check if the file resolved them when executed in any of our sandboxes. Here is the resulting rule:
import “vt”
rule malware_hosted_on_strikinglycdn {
meta:
description = “Detects malicious files hosted on strikinglycdn.com domain.”
category = “MAL”
examples = “https://www.virustotal.com/gui/search/p%253A5%252B%2520itw%253Astrikinglycdn.com%2520(behaviour_network%253A%2522oyndr.com%2522%2520or%2520behaviour_network%253A%2522fancli.com%2522)/files”
creation_date = “2023-07-11”
last_modified = “2023-07-11”
condition:
// combining existing templates
vt.metadata.analysis_stats.malicious > 5 and
vt.metadata.new_file and
// [1] checking filetype
vt.metadata.file_type == vt.FileType.PDF and
// [2] check if the file was hosted in this domain
(
vt.metadata.itw.domain.raw iendswith “.strikinglycdn.com” or
vt.metadata.itw.domain.raw == “strikinglycdn.com”
) and
// [3] check if it resolves these domains during sandbox detonation
for any dns_lookup in vt.behaviour.dns_lookups : (
dns_lookup.hostname == “oyndr.com” or
dns_lookup.hostname == “fancli.com”
)
}
Feature #2 – YARA playground
When designing a rule it is always very hard to find the right balance between over and under fitting. Is our rule detecting the samples it is based on? How many other samples are being detected by it? Does our rule detect any unintended legitimate samples? Given this is the first thing every security expert would do, we decided to make it easier to test your fresh new rule against a set of IoCs.
In the bottom of the editor you will find 3 tabs. In the TEST tab you can add a set of IOCs you want to test your rule against, as shown below.
Then we are ready to Run test and find TEST RESULTS in the next tab, showing how the tested IoCs matched our rule.
If anything happens, the PROBLEMS tab will give you details.
Additionally, when working with multiple rulesets in multiple web browser tabs at the same time, the
YARA editor displays a
message on the top right corner to help you to always keep in the spotlight the entity you are targeting with your rules.
Wrapping up
The new YARA editor is integrated with both
Livehunt and
Retrohunt, so basically will be our default editor for anything YARA-related in VirusTotal. The goal is making writing rules easier and faster, and finding everything you need, from templates to testing, in one place.
You may have noticed that the ITW feature is not included in the
official documentation, and that it was not previously possible to perform this type of check. This is because it is part of our ongoing improvements to the “vt” module for YARA, which we will be introducing to you very soon.
We hope you find all these new features as useful as we do. If you have any questions or requests please do not hesitate to
contact us.
Don’t forget to stay tuned, Netloc Hunting is coming! And as always, happy hunting!
Continue reading Actionable Threat Intel (III) – Introducing the definitive YARA editor→
