Learning Objectives

• Looking for actionable information that can be used to search for threats
• Installing YARA
• Creating a YARA rule
• Deploying a YARA rule

Prerequisites

• Basic understanding of security concepts including but not limited to Cyber Kill Chain, TTPs, Indicator of Compromise, Hashes, and APTs.
• Basic understanding of using the Windows command line and PowerShell.
• Basic understanding of data types and encoding.

Answer the question below

Q: What technique does ID T1134 describe?
A: Access Token Manipulation

Q: What does the detection rule M_APT_Dropper_Rootsaw_Obfuscated detect?
A: Detects obfuscated ROOTSAW payloads

Structured Hunting

This approach starts with a plan or hypothesis based on known attacker behaviors and strategies. You’re looking for specific patterns or signs that show an attack might be starting.

How it works:

• Searches are powered by tools like YARA rules (to find patterns) or queries in a SIEM (to analyze logs).
• Relies on external sources, like ecurity blogs or platforms that share attack details (e.g., MISP or AlienVault).

Why it’s useful:

• It’s good for investigating after a possible compromise or when new threats are reported.

Example:

• List itemFinding alware on a server after reading a blog about a similar attack.

Situational/Entity-Driven Hunting

This combines the first two approaches and focuses on what’s relevant right now for your organization. It responds to new threats or specific situations, like industry-specific risks or targeted reports.

How it works:

• Starts with a hypothesis about who might attack and what they’ll target.
• Focuses on protecting your most critical assets (e.g., financial data or customer info).
• Uses tools like the MITRE ATT&CK framework and past attack data.

Why it’s good:

• List itemIt adapts to current threats, making it highly focused and relevant.

Example:

• If your industry is being targeted by a ransomware group, you look for signs of their activity in your systems.

Trigger

This is what starts the hunt for a security threat. A trigger could be:

• A warning sign, like a suspicious file (IOC).
• A known behavior or method used by attackers (TTPs).
• An educated guess (hypothesis).
• A system acting strangely.
• Information from blogs, news, or reports from other companies.

Investigation

Once you pick a trigger, you use it to start searching for problems.

• List itemSecurity experts use tools like malware scanners, network tools (e.g., Wireshark), or rules (like YARA) to find anything unusual in the systems or files.

Resolution

If evidence of a security breach is found:

• The incident response (IR) team is informed to handle the problem.
• The threat hunter may help the IR team investigate further, find the root cause, and figure out how bad the damage is.

Opportunities

How to apply the above scenarios:

Example: The received threat intelligence details specific TTPs attributed to APT29, which is known to target political entities. This intelligence enables a structured hunting style using the TTPs included in the report to build a hypothesis.

Example: The received threat intel includes Indicators of Compromise and YARA rules to hunt for malware. This intelligence enables an unstructured hunting style using the IOCs provided.

The two opportunities above can be combined to enable a situational or entity-driven hunting style.

Answer the questions below

Q: Which threat hunting style is proactive and uses indicators of attack and TTPs?
A: structured hunting

Q: In which phase of the threat hunting process, tools like YARA or Volatility are used?
A: Investigation

Q: You have received a threat intelligence report consisting only of Indicators of Compromise. What threat hunting style do you recommend to use?
A: unstructured hunting

Structure of a YARA Rule

Yara rules are compsed by name, meta, strings, and condition.

Rule Name

The Rule name is a descriptive name for the rule and starts with the keyword rule. Best practices include setting a name that clarifies what the rule is used for.

Meta

This part defines extra information like description, author, and more. Custom identifiers and value pairs can be freely created. The information defined in meta cannot be used in the condition part. Whether to include this part or not is entirely up to you. The rule will work completely fine without it. It is, however, recommended to include the meta part with some basic information, including the author and the description of what to use the rule for.

Strings

In this part of the rule, matching strings are defined. Multiple types of strings can be defined, which is essential for creating functional rules.

Condition

In this part of the rule, a matching condition is defined using the identifiers defined in the strings part.

Answer the questions below

Q: Apart from the rule name, which other section is also required in a YARA rule?
A: condition

False positives

An important part of threat hunting is avoiding false alarms. With YARA, this means writing rules that accurately detect the specific threat. However, writing good YARA rules can be tricky and complicated, especially for specific malware. You have two options:

• Learn to write detailed YARA rules yourself.
• Use rules made by experts (like those from threat intelligence reports).

You can also combine both approaches. Even if you use pre-made rules, it’s important to understand how they work.

Answer the questions below

Q: What modifier should be used if you want to search for 2-byte encoded characters?
A: wide

Q: What condition should be used if you want to exclude the defined strings from the matching process?
A: none of them

Run a YARA Rule for the First Time

PS C:\TMP>get-content C:\TMP\YARARULES\myfirstrule.yar
rule myfirstrule 
{
    meta:
        Description = "Searches for the string tryhackme"
        Author = "TryHackMe"
    
    strings:
        $s = "tryhackme"
 
    condition:
        $s
}

This rule searches for the string tryhackme in the give directory as argument. For example if the target directory where I want to search is C:\TMP I have to run the following command.

PS C:\TMP> yara64 C:\TMP\YARARULES\myfirstrule.yar C:\TMP\
myfirstrule C:\TMP\test.txt

The result shows that the string matches inside the file C:\TMP\test.txt

Combine Multiple Rules in One File

Putting multiple YARA rules in one file can make things easier, especially when they focus on the same malware, campaign, or purpose. For example, if you’re tracking a malware family with different versions, having all the rules in one file keeps everything organized and easier to use. The same goes for investigating a phishing campaign—grouping rules for emails, payloads, and domains into one file makes the process smoother.

On the other hand, if the rules are unrelated, it’s better to keep them in separate files. This avoids confusion and makes updates easier. The idea is simple: combine rules that share a common goal to keep things clear and efficient, but don’t lump everything together just for the sake of it.

rule M_APT_Downloader_WINELOADER_1
{
    meta:
      author = "Mandiant"
      disclaimer = "This rule is meant for hunting and is not tested to run in a production environment."
      description = "Detects rc4 decryption logic in WINELOADER samples"

    strings:
      $ = {B9 00 01 00 00 99 F7 F9 8B 44 24 [50-200] 0F B6 00 3D FF 00 00 00} // Key initialization
      $ = {0F B6 00 3D FF 00 00 00} // Key size

    condition:
      all of them
}

rule M_APT_Downloader_WINELOADER_2
{
    meta:
      author = "Mandiant"
      disclaimer = "This rule is meant for hunting and is not tested to run in a production environment."
      description = "Detects payload invocation stub in WINELOADER"

    strings:

      // 48 8D 0D ?? ?? 00 00  lea rcx, module_start (Pointer to encrypted resource)
      // 48 C7 C2 ?? ?? 00 00  mov rdx, ???? (size of encrypted source)
      // E8 [4]  call decryption
      // 48 8D 05 [4]  lea rcx, ??
      // 48 8D 0D [4]  lea rax, module_start (decrypted resource)
      // 48 89 05 [4]  mov ptr_mod, rax

      $ = {48 8D 0D ?? ?? 00 00 48 C7 C2 ?? ?? 00 00 E8 [4] 48 8D 0D [4] 48 8D 05 [4] 48 89 05}

    condition:
      all of them
}

rule M_APT_Dropper_Rootsaw_Obfuscated
{
    meta:
      author = "Mandiant"
      disclaimer = "This rule is meant for hunting and is not tested to run in a production environment."
      description = "Detects obfuscated ROOTSAW payloads"

    strings:
      $ = "function _"
      $ = "new XMLHttpRequest();"
      $ = '\x2e\x7a\x69\x70'
      $ = '\x4f\x70\x65\x6e'
      $ = "\x43\x3a\x5c\x57"
      $ = "https://waterforvoiceless.org/util.php"

    condition:
      2 of them
}

Answer the questions below

Q: What option do you need to pass to ensure you scan all directories recursively?
A: -r

Exercise 1

Write a YARA rule to find the file that contains the pattern "THM{}". Use the C:\TMP\Exercise1\ path as the target in the YARA command, enter the flag as the answer.

rule exercise1
{
    strings:
      $1 = "THM{"

    condition:
      $1
}

Run as:

PS C:\TMP\YARARULES> yara64 .\exercise1.yara C:\TMP\Exercise1

Exercise 2

Write a YARA rule that finds the file that contains the following strings: "Yet another", "Ridiculous acronym". Use the C:\TMP\Exercise2\ path as the target in the YARA command. Enter the name of the file as the answer.

rule exercise2
{
    strings:
      $1 = "Yet another" wide
      $2 = "Ridiculous acronym" wide

    condition:
      $1 and $2
}

Run as:

PS C:\TMP\YARARULES> yara64 .\exercise2.yara C:\TMP\Exercise2

Exercise 3

Write a YARA rule that searches for the file that contains the base64 encoded string "THM{This was a really fun exercise}". Use the C:\TMP\Exercise3\ path as the target in the YARA command, and enter name of the file as the answer.

rule exercise3
{
    strings:
      $1 = "THM{This was a really fun exercise}" base64

    condition:
      $1
}

Run as:

PS C:\TMP\YARARULES> yara64 .\exercise3.yara C:\TMP\Exercise3

Exercise 4

Write a YARA rule that searches for the XOR encrypted string "THM{FoundSomethingHidden}" in the C:\TMP directory and subdirectories. Fill in the encrypted text and XOR key used.

rule exercise4
{
    strings:
      $1 = "THM{FoundSomethingHidden}" xor

    condition:
      $1
}

Run as:

PS C:\TMP\YARARULES> yara64 .\exercise4.yara -X C:\TMP\Exercise4

Answer the questions below

Q: What is the flag found in exercise 1?
A: THM{Threathuntingisawesome}

Q: What is the filename found in exercise 2? (Format: filename.extension)
A: file10.txt

Q: What is the filename found in exercise 3? (Format: filename.extension)
A: file13.txt

Q: What was the XOR key used for encryption in exercise 4?
A: 0x01

Q: What encrypted string did you find in exercise 4?
A: UILzGntoeRnlduihofIheedo|