Detection Rules Overview

​

How Detection Rules Work

1. Receives a report_directory path containing JSON analysis results
2. Analyzes static information (PE headers, imports, sections, etc.)
3. Analyzes dynamic behavior (API calls, registry operations, file operations, etc.)
4. Returns a detection verdict string or “CLEAN”

​

Choosing Lua vs Python

​

Lua Rules

• Fast execution and low memory overhead
• Simple pattern matching and string operations
• Rules that need to be frequently updated

• Faster execution time
• Built-in JSON parsing with utilities
• Simpler syntax for common detection patterns

​

Python Rules

• Complex data analysis
• Rules requiring external libraries
• Advanced pattern matching with regex

• Full Python standard library access
• More familiar to security researchers
• Better for complex logic and data structures

​

Rule Directory Structure

dr_rules_files/
├── utils.lua              # Lua utility functions
├── dr_semu_utils.py       # Python utility functions
├── sample_rule.lua        # Example Lua rule template
├── wannacry_url.lua       # WannaCry detection rule
├── dr_semu_eicar.py       # EICAR test detection
└── py_imports.config      # Python module whitelist

​

Analysis Data Structure

• starter.json - Initial process information (image path, PID, SHA-256)
• .json - Dynamic behavior logs for each process
• .json - Static analysis results (PE info, imports, sections)

​

starter.json Format

{
  "image_path": "C:\\sample.exe",
  "starter_pid": 1234,
  "sha_256": "abc123..."
}

​

Dynamic Behavior Format

[
  {
    "NtCreateKey": {
      "success": true,
      "before": {
        "key_path": "HKEY_LOCAL_MACHINE\\..."
      },
      "after": {
        "handle": 1234
      }
    }
  }
]

​

Static Analysis Format

{
  "generic": {
    "is_x86": true,
    "is_dll": false
  },
  "imports": [...],
  "sections": [...]
}

​

Quick Start Example

utils = require "utils"

function check(report_directory)
    local status = "CLEAN"
    
    local first_dynamic = utils.get_first_process_json(report_directory)
    
    if first_dynamic ~= nil then
        for index, win_func in pairs(first_dynamic) do
            if win_func.NtCreateKey then
                if win_func.NtCreateKey.before.key_path:find("malicious_key") then
                    return "Malware.Detected"
                end
            end
        end
    end
    
    return status
end

import dr_semu_utils

def check(report_directory):
    verdict = b"CLEAN"
    
    image_path, pid, sha_256 = dr_semu_utils.get_starter_details(report_directory)
    dynamic_info = dr_semu_utils.get_json_from_file(
        report_directory + b"\\" + str(pid).encode() + b".json"
    )
    
    for win_func in dynamic_info:
        if "NtCreateKey" in win_func:
            key_path = win_func["NtCreateKey"]["before"]["key_path"]
            if "malicious_key" in key_path.lower():
                return b"Malware.Detected"
    
    return verdict

​

Next Steps