DEV Community

Raghavvram Johnson
Raghavvram Johnson

Posted on

Yara Rule (Malware Detection)

#yara #malware #detection #memory

RegEx in Yara

==Yes, regular expressions are fully supported in YARA==.

How to Use Regex in YARA

In a YARA rule, regular expressions are defined inside the strings section by enclosing them in forward slashes (/) instead of double-quotes:

rule ExampleRegexRule {
    strings:
        $re1 = /md5: [0-9a-fA-F]{32}/
        $re2 = /state: (on|off)/
    condition:
        $re1 and $re2
}
Enter fullscreen mode Exit fullscreen mode

Supported Modifiers

You can attach string modifiers to your regular expressions:

  • nocase or the i flag (placed after the closing slash, e.g., /foo/i): Ignores case.
  • s flag (e.g., /bar./s): Allows the dot (.) character to match newline characters.
  • ascii and wide: Matches ASCII or UTF-16/wide-character equivalents.
  • fullword: Ensures the match is not preceded or followed by an alphanumeric character.

Limitations of YARA's Engine

YARA uses its own internal regular expression engine (rather than full PCRE), which has a few important constraints: [1]

  • No capture groups: You cannot use backreferences or group-capturing features.
  • No POSIX character classes: Classes like [[:alpha:]] or [[:digit:]] are not supported (though standard shorthand like \d, \w, and \s work).
  • No lookaheads / lookbehinds: Features like negative lookahead ((?!...)) are not supported and will trigger compilation errors.
  • Performance impact: Overly broad regex patterns (especially leading wildcard patterns like .*) can slow down scanning speeds because YARA has to evaluate them across the target file or memory space.

Wildcard in Yara Strings

In YARA (a tool used for malware research and pattern matching), the question mark (?) acts as a wildcard that matches any single byte in a hexadecimal string pattern.

Example Usage in Hex Strings:

  • 01 ? 03: Matches a sequence starting with 01, followed by any single byte, and then 03.
  • AA ?? CC: Matches AA followed by any two individual wildcard bytes, and then CC.

Yara for Memory Analysis

Using YARA for memory analysis ==allows you to scan RAM dumps, live processes, or memory images for malicious signatures, injected code, and fileless malware==.

Step 1: Acquire a Memory Dump

Before YARA can scan memory, you need to capture a snapshot of the target system's RAM:

  • Windows/Linux/macOS: Use dedicated memory acquisition tools like WinPMem, Volatility (vmem/raw dumps), DumpIt, or LiME (Linux Memory Extractor) to save physical memory to a file (e.g., memory.dmp or ram.raw).
  • Live Process Scanning (Direct): On supported endpoint protection agents (such as Trend Micro Apex Central), you can run YARA memory scans directly on active processes without manually dumping the full disk/RAM image first.

Step 2: Write or Obtain a YARA Rule

A YARA rule consists of metadata, pattern strings (text, hex, or regular expressions), and a matching condition:

rule Detect_Suspicious_Memory_Pattern {
    meta:
        description = "Detects injection or malicious strings in memory"
        author = "Analyst"
        date = "2026-03-31"
    strings:
        $cmd = "cmd.exe /c powershell" ascii wide
        $hex_pattern = { 4D 5A 90 00 03 00 00 00 } // DOS/PE header or shellcode
    condition:
        any of them
}
Enter fullscreen mode Exit fullscreen mode

Step 3: Run YARA Against a Memory Dump

You can run the standard YARA command-line tool directly against a raw memory dump file:

yara -s /path/to/rule.yar /path/to/memory.dmp
Enter fullscreen mode Exit fullscreen mode
  • -s: Prints the matching strings found inside the memory dump.
  • -p <number>: Sets the number of threads to speed up large memory image scans.

Step 4: Use YARA with Memory Forensics Frameworks (E.g., Volatility)

Frameworks like Volatility include built-in plugins to run YARA signatures directly against virtual address spaces or physical memory pages:

  • In Volatility 3: Use the yarascan plugin to search a memory image for matches:

    vol -f memory.dmp windows.yarascan.YaraScan --yara-file /path/to/rule.yar

  • This scans process memory spaces, kernel memory, and unallocated slack space, outputting the exact virtual addresses, process names (e.g., svchost.exe), and matching rule names.

Best Practices for Memory Analysis

  • Account for Volatility/Structure: Memory is fragmented. Strings might be split across page boundaries, or encoded (XOR/Wide-char ASCII/UTF-16). Use modifiers like wide and ascii in your YARA string definitions.
  • Filter by Process: Cross-reference YARA memory hits with process lists (pslist or netscan in Volatility) to confirm whether the matched memory region belongs to a legitimate service or a rogue/injected process.
  • Tune for False Positives: Raw RAM contains vast amounts of normal application data; keep conditions specific to avoid noise from common strings.

Top comments (0)