File hunting: Writing YARA rules for Livehunt

Livehunt uses an up-to-date version of YARA, which means that the latest YARA documentation is usually the place to go for a detailed description of the language and its features. However, there are a few things that you need to know while creating YARA rules specifically tailored for Livehunt.

• Rules for which YARA raise performance warnings are not accepted by Livehunt. Such rules are usually very slow and degrade the service both for you and the rest of the users.

• You can not use include statements in your rules.

• Standard modules currently supported are: pe, elf, math, magic, hash, cuckoo, and dotnet.

• In addition to the standard modules enumerated above, you can also the vt module, which was specifically created for Livehunt and exposes additional information about the file being scanned. Keep reading for more information about this module.

Using file's metadata in your rules

The vt module

Creating rules based on file behavior

HTTP Methods

Network Protocols

Behaviour traits

Behaviour verdicts

File types

Legacy variables

Using file's metadata in your rules

Most YARA rules are based in patterns found inside the files themselves, however this is not always enough. Sometimes you may need to create rules that leverage additional information that Google Threat Intelligence has about the file. For example, you may want to create a rule that only applies to a certain file type, or files that are detected by at least one antivirus, or perhaps you are only interested in files that are submitted to Google Threat Intelligence for the first time or from a given country. All these cases, and many more, can be expressed in your YARA rules.

In order to expose all the information that Google Threat Intelligence have about the file being scanned we have created a custom YARA module named vt. This module contains metadata like antivirus signatures, file type, file behavior, submitter, etc. The vt module replaces the previous mechanism for exposing file's metadata based in custom variables like signatures, positives, file_name, and so on. These variables have been deprecated, but they will continue to work and are still documented in the Legacy variables section.

The vt module

⚠️

The vt module always matches the last submission, i.e. the one that generated the YARA matching event.

The vt module exposes all the metadata that Google Threat Intelligence has about a file to YARA, so that you can create Livehunt rules based on that metadata. Let's see some examples:

import "vt"  
  
rule infected_pe {  
  condition:  
    vt.metadata.analysis_stats.malicious > 1 and vt.metadata.file_type == vt.FileType.PE_EXE  
}

import "vt"  
  
rule new_file_from_china {  
  condition:  
    vt.metadata.new_file and vt.metadata.submitter.country == "CN"  
}

import "vt"  
  
rule zbot {  
  condition:  
    for any engine, signature in vt.metadata.signatures : (  
      signature contains "zbot"  
    )  
}

From the examples above you probably already got the idea. The vt module has a lot of information about the file being scanned, and that information can be used in your Livehunt rules for filtering unwanted files and focusing in what you are really looking for. You are not limited to creating rules based on file content alone, there is a lot of metadata at your disposal as you can see in the table below.

Back to top

Creating rules based on file behavior

The vt module not only exposes information about the file itself and how it was detected by antivirus engines, it also exposes information about how the file behaves. In Google Threat Intelligence we run executable files through multiple sandboxes, which include our own in-house developed sandbox called Jujubox, and some third-party sandboxes. The behavioral information generated by all those sandboxes is normalized into a common format, and mixed together as if it was generated by a single sandbox. This aggregated behavior report is what the vt module exposes to your rule. Here you have a few examples:

import "vt"  
  
rule drops_foo_exe {  
  condition:  
    for any file_dropped in vt.behaviour.files_dropped : (  
      file_dropped.path contains "foo.exe"  
    )  
}

import "vt"  
  
rule mutex_hgl345 {  
  condition:  
    for any mutex in vt.behaviour.mutexes_created : (  
       mutex == "HGL345"  
    )  
}

import "vt"  
  
rule persistence_and_self_deletion {  
  condition:  
    for any trait in vt.behaviour.traits : ( trait == vt.BehaviourTrait.PERSISTENCE ) and  
    for any trait in vt.behaviour.traits : ( trait == vt.BehaviourTrait.SELF_DELETE )  
}

The list below describes all the existing behaviour-related fields:

Back to top

HTTP methods

Network protocols

Behaviour traits

Behaviour verdicts

Back to top

File types

Back to top

Legacy variables

YARA offers a mechanism for defining custom variables that has been used in Livehunt for providing additional information about the file being scanned. These variables are now deprecated in favor of our vt module, but they will continue to work as always for backward compatibility. You can find list of variables defined by Livehunt below, but we highly encourage you to start using the vt module instead.

Back to top

Google TI assessment severity types

Back to top

Google TI assessment verdicts

Back to top