Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updated YARA rules do not re-alert #5

Open
austinbyers opened this issue Jul 25, 2017 · 2 comments
Open

Updated YARA rules do not re-alert #5

austinbyers opened this issue Jul 25, 2017 · 2 comments
Assignees

Comments

@austinbyers
Copy link
Collaborator

All YARA matches are saved to DynamoDB, but alerts are only sent to SNS if the YARA rule name has not matched before on the given binary. There are two problems with this:

  1. Rules which are renamed or reorganized will re-trigger alerts
  2. Rules whose content changes (e.g. a different rule condition) will not re-trigger an alert

Instead of looking up based on the rule name, there should be a comparison against some kind of hash of the YARA rule contents

@austinbyers austinbyers added this to the 1.0.0 milestone Jul 25, 2017
@austinbyers
Copy link
Collaborator Author

austinbyers commented Aug 25, 2017

Unfortunately, this is going to be a bit tricky, as neither YARA or yara-python provide access to internal rule logic, so it's currently not possible to compute a hash of rule logic.

The best solution (which would also help support the ability to lint and modify YARA rules) would be to have a full Python YARA parser.

@austinbyers austinbyers modified the milestones: 1.0.0, 1.1.0 Aug 25, 2017
@austinbyers austinbyers removed this from the v1.1.0 milestone Nov 20, 2017
@austinbyers
Copy link
Collaborator Author

Another caveat: just because a rule was slightly modified does not necessarily mean we would want to re-alert on all previous matches. This requires some more consideration

@austinbyers austinbyers removed the bug label Aug 29, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant