YARA Rules Management

YARA Rules Management

LitterBox runs YARA in two analysis modes using the same rules file.

Configuration

Both static and dynamic analysis use the same YARA rules:

static.yara:
  rules_path: ".\\Scanners\\Yara\\LitterBox.yar"
  command: "{tool_path} -s -m {rules_path} {file_path}"

dynamic.yara:
  rules_path: ".\\Scanners\\Yara\\LitterBox.yar"
  command: "{tool_path} -s -m {rules_path} {pid}"

Rules File Structure

Main File: .\Scanners\Yara\LitterBox.yar

LitterBox.yar is a master include file that references all individual rule files in the Rules subdirectory:

include ".\rules\Linux_Backdoor_Bash.yar"
include ".\rules\Windows_Trojan_Cobalt.yar"
include ".\rules\Technique_ProcessHollowing.yar"
include ".\rules\Tool_Mimikatz.yar"
// ... more includes

Directory Structure

Scanners/Yara/
├── yara64.exe
├── LitterBox.yar              # Master include file
└── Rules/                     # Individual rule files
    ├── Linux_Backdoor_Bash.yar
    ├── Windows_Trojan_Cobalt.yar
    ├── Technique_ProcessHollowing.yar
    ├── Tool_Mimikatz.yar
    └── ... (other .yar files)

Adding New Rules

Method 1: Create New Rule File

1. Create new .yar file in Rules/ directory
2. Add include statement to LitterBox.yar:

include ".\Rules\YourNewRules.yar"

Method 2: Edit Existing Rule File

Edit any existing .yar file in the Rules/ directory

Helper Script

Generate Master Rules File - PowerShell script to automatically create include statements:

param (
    [string]$RulesDirectory, # Path to the directory containing .yar files
    [string]$OutputFile = "master_rules.yar" # Name of the master rules file
)

# Check if the specified directory exists
if (-Not (Test-Path -Path $RulesDirectory -PathType Container)) {
    Write-Error "The specified directory does not exist: $RulesDirectory"
    exit 1
}

# Get all .yar files in the directory
$yarFiles = Get-ChildItem -Path $RulesDirectory -Filter "*.yar"
if ($yarFiles.Count -eq 0) {
    Write-Error "No .yar files found in the directory: $RulesDirectory"
    exit 1
}

# Write include statements to the master rules file
try {
    $outputPath = Join-Path -Path $RulesDirectory -ChildPath $OutputFile
    # Clear the output file if it exists
    if (Test-Path $outputPath) {
        Remove-Item -Path $outputPath -Force
    }
    # Write include statements for each .yar file
    foreach ($file in $yarFiles) {
        $relativePath = $file.Name
        Add-Content -Path $outputPath -Value "include `"$relativePath`""
    }
    Write-Host "Master rules file generated successfully at: $outputPath"
} catch {
    Write-Error "An error occurred while generating the master rules file: $_"
}

Usage:

.\generate_rules.ps1 -RulesDirectory ".\Scanners\Yara\Rules" -OutputFile "LitterBox.yar"

Analysis Modes

Static Analysis

• Scans uploaded files
• Uses {file_path} placeholder
• Command: yara64.exe -s -m LitterBox.yar sample.exe

Dynamic Analysis

• Scans process memory
• Uses {pid} placeholder
• Command: yara64.exe -s -m LitterBox.yar 1234

Command Flags

• -s - Print string matches
• -m - Print metadata