0

I have a yara rule that looks for multiple strings in a file and fires if the count is greater than 3. But how would I change the condition statement to only fire if greater than 3 but less than 5?

Essentially I want something like this

3 < (#var_*) < 10

But this statement is not valid syntax. Is there a way to use the count operator # with a wildcard *?

rule strings
{
    meta:
        notes = "testing"
    strings:
        var_01 = "string1"
        var_02 = "string2"
        var_03 = "string3"
        var_04 = "string4"
        var_05 = "string5"
        var_06 = "string6"
        var_07 = "string7"
        var_08 = "string8"
    condition:
        3 of ($var_*)
}

closed as off-topic by ThoriumBR, Xander, multithr3at3d, forest, A. Hersean Aug 19 at 11:55

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Xander, multithr3at3d, A. Hersean
If this question can be reworded to fit the rules in the help center, please edit the question.

  • What you want would require a parser of the parser since you are talking about variable names. You are also creating a confusing bit of logic for the parser. Do you mean 3 of each? 3 of one? 3 of a combination? I think the best course of action is just to spell it all out. – schroeder Aug 13 at 15:50
  • @bigC5012 You'd better ask this on stackoverflow – user211258 Aug 13 at 15:51
  • Not all applications do interpret the * symbol as a wildcard, symbols like this can have other functionalities such as multiplying – user211258 Aug 13 at 16:09
  • thanks for the help. I'll go ahead and post over on stackoverflow. The logic i'm looking for is the presence of any of the strings but only if greater than a certain value and less than a certain value. So this currently works if any 1 string fires 3 times or 3 separate strings fire at least 3 times. The problem is I do not want this to fire if the occurrence is greater than a value. – bigC5012 Aug 13 at 16:53
1

Your rule condition will match if at least 3 of the string found, not the count of all the string found. Because Yara doesn't mix the wildcard identifier(*) with counts(#), you can only use regex to simplified the count.

rule countstr
{
    strings:
        $a1 = /(string1|string2|string3|string4|string5|string6|string7|string8)/
    condition:
        #a1 > 3 and #a1 < 10
}

Bear in mind that regex cannot compete with plain string matching. For performance concern, you need to resort to something like the following.

rule countstr2
{
    strings:
        $a1 = "string1"
        $a2 = "string2"
        $a3 = "string3"
        $a4 = "string4"
        $a5 = "string5"
        $a6 = "string6"
        $a7 = "string7"
        $a8 = "string8"
    condition:
        (#a1+#a2+#a3+#a4+#a5+#a6+#a7+#a8) > 3 and (#a1+#a2+#a3+#a4+#a5+#a6+#a7+#a8) < 10
}

Not the answer you're looking for? Browse other questions tagged or ask your own question.