reversinglabs / reversinglabs-yara-rules Goto Github PK

The Unicode characters in the file blocklist.yara cause problems in different tools that process YARA rules.
I cannot find any reference in the documentation but I am pretty sure that the standard doesn't allow Unicode characters in YARA rule files.

Maybe you could include the statements in an encoded form? e.g. 重庆话语科技有限公司 as \u91CD\u5E86\u8BDD\u8BED\u79D1\u6280\u6709\u9650\u516C\u53F8

Could you try to implement that and check if the rule would still match on the respective samples?

Thanks a lot for the project, it's great. Would you add UUID for each rule? We would like to import the rules to make those available on cycat.org.

Systems: Microsoft Windows Server 2019, ca. 86 Windows 10pro Clients and handful Windows 11 pro

Using Yara rules, we get the following false positives (with some variations on some clients:
CobaltStrike_Resources_Artifact64_v1_49_v2_x_v3_0_v3_3_thru_v3_14 /media/5AC48A90C48A6E57/pagefile.sys CobaltStrike_Resources_Reverse_Bin_v2_5_through_v4_x /media/5AC48A90C48A6E57/pagefile.sys CobaltStrike_Resources_Artifact32_v3_14_to_v4_x /media/5AC48A90C48A6E57/pagefile.sys CobaltStrike_Resources_Dnsstager_Bin_v1_47_through_v4_x /media/5AC48A90C48A6E57/pagefile.sys CobaltStrike_Resources__Template_Vbs_v3_3_to_v4_x /media/5AC48A90C48A6E57/pagefile.sys CobaltStrike_Resources_Artifact32svc_Exe_v3_1_v3_2_v3_14_and_v4_x /media/5AC48A90C48A6E57/pagefile.sys

For full detailes reports see https://www.heise.de/forum/heise-Security/Themen-Hilfe/Desinfect/CobaltStrike-auf-Exchange-Server-gefunden/thread-7244749/

Something happened to your master branch.

People started noticing it since I use download links to packages generated from that branch. I don't know if I want to use rules from a development branch in production.

https://github.com/Neo23x0/Loki/pull/148/files

The rule set in yara/certificate/blocklist.yara uses a syntax, which cannot be used in previous versions of YARA.

Previous Syntax

      for any i in (0 .. pe.number_of_signatures) : (
         pe.signatures[i].issuer contains "VeriSign Class 3 Code Signing 2010 CA" and
         pe.signatures[i].serial == "78:62:07:2d:dc:75:9e:5f:6a:61:4b:e9:b9:3b:d5:21"
      )

Syntax used in blocklist.yara

        for any s in pe.signatures: (
            s.subject contains "FAN-CHAI, TOV" and
            s.serial == "08:dd:cc:67:f8:ca:d6:92:96:07:e4:cd:a2:9b:35:03" and
            1564310268 <= s.not_after
        )

I don't know if you want your ruleset to be compatible with previous YARA versions or used the new syntax intentionally.
I can only tell you that many products don't use YARA 4 yet.