Are malware detection rulesets publicly discoverable?

Question

I am uncertain about how public malware detection rulesets are? By a "ruleset" I mean the rules, usually written in Yara, that malware detection engines use to determine whether a file or memory sequence is potentially malware.

I know that different detectors definitely use different rulesets, because if you use Virus Total or some similar service, you can see that for a given binary some of the vendors will flag the binary and others will not. I would expect a vendor's ruleset to be "secret sauce" that they would not release publicly.

Nevertheless, I can't see how it would be secret. For example, I have Symantec Endpoint running on my desktop, so in theory it has a file somewhere it is reading which has the ruleset in it. Therefore, getting the rules should be as simple as finding that file. Of course, there is the possibility that the ruleset on my desktop is different than the one Symantec has on its servers. So, on the desktop I might just be getting the "old" stuff that everybody knows, and all the really valuable rules are only on their servers and thus inaccessible.

So, are these rulesets considered "secret" or are they publicly available or somewhere in between?

Answer 1

Finding the signatures is generally easy. They are usually identified as such, and the files downloaded when updating the AV signatures obviously contain signatures.

Now, getting a binary file that somehow is used to detect, is not of much use unless you also know how it is structured (the "language" they use). Which is typically undocumented.

I recommend you to take a look to ClamAV. This is an open-source antivirus, so you have both the rules, and the code that uses it. Neatly documented.

Finally, even if you have a rule and understand it means «bytes 34 28 50 5e 29 37 43 43 29 37 7d 24 45 49 43 41 52 are malicious at position 0x10 of a file», that doesn't embed the knowledge behind treating it as such. Is it part of an infection routine? A packer? An instruction attempting to detect VMs?

Answer 2

I really think that the signature database ( containing malware signatures and blacklisted dns and domains ) that all antiviruses have are on the device the software has been installed to, but this not a big deal as most of them have the SAME threats but with different identifications and names and removal methods ( depends on how they did that in their labs ) { they literally cheat from each others }

BUT THE BIG DEAL is around the AUTO-PROTECT and Sandboxing technologies and of course INTRUSION DETECTION and REAL TIME and END POINT and FIREWALL Features and ANTI-EXPLOITING functions. Those mentioned are all private codes that really took them a lot of good work. These are already implemented algorithms and thresholds and testing functions made when programming the software itself they tend to update those once in a while. The earlier mentioned ones ( which are databases of signatures and websites ) are on the other hand updated on a daily basis as new threats are identified every day.

So basically, you can find the database on your computer with some digging ... I even think you can get that list ( fresh ) somewhere on the internet or darknet ... can't remember its name .. but am sure it is there somewhere.

It's useless anyway unless you need to make sure your codes aren't identified as malicious OR you are thinking about building your own AV.