Learning Malware Analysis

7.4.2 YARA Rule Basics

Once installed, the next step is to create YARA rules; these rules can be generic or very specific, and they can be created using any text editor. To understand the YARA rule syntax, let's take an example of a simple YARA rule that looks for suspicious strings in any file, as follows:

rule suspicious_strings{ strings:    $a = "Synflooding"    $b = "Portscanner"    $c = "Keylogger"condition:    ($a or $b or $c)}

The YARA rule consists of the following components:

• Rule identifier: This is a name that describes the rule (suspicious_strings in the preceding example). The rule identifiers can contain any alphanumeric character and the underscore character, but the first character cannot be a digit. The rule identifiers are case-sensitive ...