4

I'm going through the Malware Cookbook PEScanner and they want a path to my YARA files to search on. I currently have a directory full of YARA rules for known pieces of malware.

What would be the best way to run the scanner using all my YARA files at once? Is it merging? Is it looping through in the code?

Does PEScanner do either or both of these?

Improve this question
0

1 Answer 1

Reset to default
1

There are two primary ways to scan for the IoCs in Yara files:

  1. Against files on disk using a tool such as Loki.exe. Loki requires yara and will scan Windows machines looking for IoCs.
  2. Versus memory dumps available through a variety of memory-dumping tools. The Volatility Framework includes a plugin called yarascan with can specify Yara-rules file by using the -y flag. Many newcomers are now using the Rekall Forensics framework (a fork of Volatility) for its simplicity and extensibility.

Below I combine Loki's signature-base yara folder (full of Yara-rules files) with Volatility against a memory dump I gathered using MoonSols DumpIt.

for i in `echo /opt/signature-base/yara/*` ; do vol.py --profile Win7SP1x64 -f 110138-E7440-20160328-191617.raw yarascan -y $i ; done

You will likely want to prep your DFIR workstation with a ramdisk in order to gain some performance increases when running analyses such as these.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .