yara::rules

rule suspicious_upx
{
  meta:
    author = "you"
    description = "find UPX packed samples"
  strings:
    $mz = { 4D 5A }
    $upx1 = "UPX0" ascii
    $upx2 = "UPX1" ascii
  condition:
    $mz at 0 and 1 of ($upx*)
}

$a = "powershell" ascii nocase
$b = "cmd.exe /c" wide
$c = /https?:\/\/[A-Za-z0-9._-]+/ ascii
$d = { 68 ?? ?? ?? ?? 6A 00 6A 00 }

# useful modifiers
ascii  wide  nocase  fullword  xor  base64  base64wide  private

# at least N strings
condition:
  2 of ($api*)

# all strings in a set
condition:
  all of ($ps*)

# filesize + section checks
condition:
  filesize < 500KB and $mz at 0

# suspicious PE imports
condition:
  pe.is_pe and
  3 of ("VirtualAlloc","WriteProcessMemory","CreateRemoteThread")

# offset / count logic
condition:
  #url > 3 and @mz[1] == 0

import "pe"
import "hash"
import "math"
import "dotnet"
import "elf"

# examples
pe.machine == pe.MACHINE_AMD64
pe.number_of_sections > 6
math.entropy(0, filesize) > 7.2
hash.md5(0, filesize) == "..."

$a = "flag{" xor                 # try all 255 single-byte keys
$b = "flag{" xor(0x01-0xff)       # restrict key range
$c = "cmd.exe" xor ascii wide     # combine with encodings
$d = "http://" base64             # 3 b64 alignments as they appear mid-stream
$e = "http://" base64wide         # base64 of the UTF-16LE form
$f = "AdminToken" base64("")  # custom alphabet

# entropy gate for packed/encrypted regions
math.entropy(0, filesize) > 7.0
# xor() catches key-obfuscated strings with no known key

yara rules.yar sample.bin
yara -r rules/ samples/
yara -s rules.yar sample.bin      # print matching strings
yara -m rules.yar sample.bin      # print meta
yara -n rules.yar sample.bin      # fast mode
yarac rules.yar compiled.yarc
yara compiled.yarc sample.bin

# scan memory dumps carefully; pre-filter first

yara -s rule.yar sample.bin
yara -D rule.yar sample.bin     # warnings / rule diagnostics

# develop iteratively
1. start with one reliable string
2. verify on positive sample
3. test against benign files
4. add thresholds, sizes, pe checks
5. remove noisy generic strings

rule loader_combo
{
  strings:
    $s1 = "VirtualAlloc" ascii wide
    $s2 = "WriteProcessMemory" ascii wide
    $s3 = "CreateRemoteThread" ascii wide
    $s4 = "powershell -enc" ascii nocase
  condition:
    pe.is_pe and 2 of ($s1,$s2,$s3) or $s4
}

strings -a sample.bin | grep -Ei "http|powershell|cmd.exe|rundll32|regsvr32"
peframe sample.exe
lief / rabin2 / objdump for imports + sections
ssdeep / tlsh for similarity clustering

# Volatility3 — all process + kernel space
vol -f mem.raw yarascan.YaraScan --yara-rules /rules/mal.yar
vol -f mem.raw yarascan.YaraScan --yara-file mal.yar --pid 1234
vol -f mem.raw windows.vadyarascan --yara-rules "flag{"

# MemProcFS — mount, then scan the FS view
yara -r rules.yar M:/pid/1234/

# raw dump directly (noisy — scope it) / live PID
yara -r --fast-scan rules.yar mem.raw
yara -r rules.yar 1234