100daysofyara/2023

Rules Shared by the Community from 100 Days of YARA 2023

100 Days of YARA Part 2 - Electric Detectaloo

Apologies in advance for the terrible naming, but welcome to 100 Days of YARA! This repository will act as the store for all YARA ideas created during this time. Any fun scripts, tools, or rules you write can be committed to this GitHub repository! For now, any associated blogging, walkthroughs, or other musing can be hosted elsewhere :)

So what is all this any way?

In short, #100DaysofYARA is place on the internet where malware analysts, detection engineers, and reversers share ideas for YARA rules, tips for rule creation, or methods of using YARA in unconventional ways.

We'll create a new repository for each calendar year, but the structure can be pretty free-form! At some point there will be style and structural requirements for YARA rules submitted (tabs vs spaces, necessary metadata like author, date, things like that) but the general vibes are positive and uplifting so go wild with your most outlandish rules!

It is not lost on me that we could just fork Florian Roth's repositories here and call it good on detection, but this event is about advancing your own YARA skills, whether it is your first rule or your 1000th. Documenting that learning journey is important, especially for most of us late-stage adopters who probably did not major in computer science (there will be a rant on this), so think of committing to this repo as slightly-public diary about malware detection where your pals can help you and encourage you along the way.

There will be an initial walkthrough for how to use GitHub for this for those that aren't familiar, once I get around to writing it.

For now, let those YARA ideas ferment and write em down so you have content to spare - #100DaysofYARA2 starts Jan 1, 2023!

2023's Issues

idea: add a default license and encourage contributors to add a license in the meta section

to actually make some use of all the nice rules here, it would be useful if some license would be attached. you could add a default license to the repo and encourage contributors to add a license in the meta section, if they don't like the default e.g.:

private rule webshell_encoded_stats : WEBSHELL PROD {
	meta:
		description = "Webshell having statistical signs of encoded code which gets dynamically executed"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		license = "https://creativecommons.org/licenses/by-nc/4.0/"
		author = "Arnim Rupp"
		date = "2021/02/07"
	condition:
...

idea: integrate yara-ci

YARA-CI helps you to keep your YARA rules in good shape. It can be integrated into any GitHub repository containing YARA rules, and it will run automated tests every time you make some change. The automated tests include:

Rules validation
Detection of false positives
Detection of false negatives

https://yara-ci.cloud.virustotal.com/