YARA Authoring

# macOS
brew install yara-x

# Or from source
cargo install yara-x

# Verify installation
yr --version

pip install yara-x
# or with uv
uv pip install yara-x

/plugin install trailofbits/skills/plugins/yara-authoring

rule MAL_Win_Emotet_Loader_Jan25
{
    meta:
        description = "Detects Emotet loader via unique mutex and C2 path"
        author = "Your Name <[email protected]>"
        reference = "https://example.com/analysis"
        date = "2025-01-29"
        score = 85

    strings:
        // Mutex names are gold - unique to this malware family
        $mutex = "Global\\M4884" ascii wide
        
        // C2 path pattern - silver tier indicator
        $c2_path = /\/api\/[a-z]{8}\/bot\.php/ ascii
        
        // Configuration marker - bronze tier
        $cfg = { 43 4F 4E 46 49 47 [0-10] 45 4E 44 }

    condition:
        filesize < 2MB and
        uint16(0) == 0x5A4D and  // PE magic bytes
        2 of them
}

{CATEGORY}_{PLATFORM}_{FAMILY}_{VARIANT}_{DATE}

meta:
    description = "Detects Example malware via unique mutex and C2 path"
    author = "Your Name <[email protected]>"
    reference = "https://example.com/analysis"
    date = "2025-01-29"

condition:
    uint16(0) == 0x5A4D and  // PE magic bytes
    filesize < 10MB and
    // Good: Mutex names, PDB paths, C2 paths
    // Bad: API names, Windows paths
    $mutex and $pdb

condition:
    // Mach-O magic bytes
    (uint32(0) == 0xFEEDFACE or   // 32-bit
     uint32(0) == 0xFEEDFACF or   // 64-bit
     uint32(0) == 0xCAFEBABE) and // Universal binary
    filesize < 10MB and
    // Good: Keylogger strings, persistence paths, credential theft
    any of ($behav*)

condition:
    filesize < 5MB and
    // ERC-20 function selectors for wallet draining
    2 of ($erc20_*) and
    // Confirm npm/JS context
    any of ($npm_context*, $js_context)

import "crx"

rule SUSP_CRX_HighRiskPerms {
    condition:
        crx.is_crx and
        for any perm in crx.permissions : (perm == "debugger")
}

import "dex"

rule SUSP_DEX_DynamicLoading {
    condition:
        dex.is_dex and
        dex.contains_class("Ldalvik/system/DexClassLoader;")
}

Is this string good enough?
├─ Less than 4 bytes?
│  └─ NO — find longer string
├─ Contains repeated bytes (0000, 9090)?
│  └─ NO — add surrounding context
├─ Is an API name (VirtualAlloc, CreateRemoteThread)?
│  └─ NO — use hex pattern of call site instead
├─ Appears in Windows system files?
│  └─ NO — too generic, find something unique
├─ Unique to this malware family?
│  └─ YES — use it

Should I require all strings or allow any?
├─ Strings are individually unique to malware?
│  └─ any of them (each alone is suspicious)
├─ Strings are common but combination is suspicious?
│  └─ all of them (require the full pattern)
├─ Seeing many false positives?
│  └─ Tighten: switch any → all, add more required strings

rule MAL_NPM_ChalkDebug_Sept25
{
    meta:
        description = "Detects malicious wallet-drainer code from chalk/debug npm supply-chain compromise"
        author = "Stairwell Threat Research (adapted)"
        reference = "https://stairwell.com/resources/npm-supply-chain-attacks-yara/"
        date = "2025-09-11"
        score = 95

    strings:
        // Unique function names from the malicious payload
        $s1 = "runmask" ascii
        $s2 = "checkethereumw" ascii

        // Ethereum function selector for approve(address,uint256)
        // This ERC-20 method grants token spending permission
        $function_selector = "0x095ea7b3" ascii

    condition:
        filesize < 5MB and
        all of them
}

condition:
    filesize < 10MB and           // 1. Instant
    uint16(0) == 0x5A4D and       // 2. Nearly instant
    2 of ($string*) and           // 3. String matches (cheap)
    pe.imphash() == "..." and     // 4. Module checks (expensive)
    for all section in pe.sections : (...)  // 5. Loops (most expensive)

yr check --relaxed-re-syntax rules/  # Identify issues
# Fix each issue, then:
yr check rules/  # Verify without relaxed mode

uv run yara_lint.py rule.yar
uv run yara_lint.py --json rules/
uv run yara_lint.py --strict rule.yar

uv run atom_analyzer.py rule.yar
uv run atom_analyzer.py --verbose rule.yar