File hunting

Creating rules based on file metadata

The vt.metadata module exposes all the metadata that Google Threat Intelligence has about a file to YARA, so that you can create Livehunt rules based on that metadata. Let's see some examples:

import "vt"
rule infected_pe {
  condition:
    vt.metadata.analysis_stats.malicious > 1 and vt.metadata.file_type == vt.FileType.PE_EXE
}

import "vt"
rule new_file_from_china {
  condition:
    vt.metadata.new_file and vt.metadata.submitter.country == "CN"
}

import "vt"
rule zbot {
  condition:
    for any engine, signature in vt.metadata.signatures : (
      signature contains "zbot"
    )
}

Using file's metadata in your rules

Most YARA rules are based in patterns found inside the files themselves, however this is not always enough. Sometimes you may need to create rules that leverage additional information that Google Threat Intelligence has about the file. For example, you may want to create a rule that only applies to a certain file type, or files that are detected by at least one antivirus, or perhaps you are only interested in files that are submitted to Google Threat Intelligence for the first time or from a given country. All these cases, and many more, can be expressed in your YARA rules.

Fields

Characteristics

File analysis

GOresym

GTI assesment

Submissions

Back to top