YARA is an open-source malware analytic tool that the Trellix appliances support. YARA rules help analysts identify and classify malware samples by creating groups of malware families based on byte-level rules to quickly analyze large quantities of files for matches. If the analysts identify a suspicious byte pattern, they can create a new YARA rule to identify likely malicious files. YARA integration results report whether an unknown file has been previously classified as malicious.
YARA rules are written and uploaded to the appliance as ASCII text files. The use of YARA rules is enabled by default.
You can define YARA rules that are specific to a particular file type, such as pdf, exe, or docx, or common rules that apply to all file types.
You can define the following content types:
Base content—Allows the appliance to apply the YARA rule to a particular file type or to all common file types. The appliance does not extract the macro from the attachment.
Active content—Allows the appliance to apply the YARA rule to DOC, DOCX, PPT, PPSX, PPTX, XLS, XLSX, or common file types. The appliance extracts the macro from the attachment for analysis.
Base content and Active content—Allows the appliance to apply the YARA rule to DOC, DOCX, PPT, PPSX, PPTX, XLS, XLSX, or common file types. The appliance analyzes the attachment and extracts the macro from the attachment for analysis.
Note
The Extended Forensics module supports uploading and deleting YARA files via the UI. It includes API endpoints for programmatic file management.
Trellix appliances identify the file type of a suspicious sample file and then apply YARA rules to a collection of files in the following order:
YARA rules that apply to common (all supported) file types
Custom YARA rules that apply to common (all supported) file types
Custom YARA rules specific to a selected file type
You can create your own YARA rules or use the rules provided by Trellix. By default, every custom YARA rule has an integer weight associated with it, ranging from 0 to 100. During static analysis, when a YARA rule match is made, the weight of the matched rule is added to the overall score of the file deemed malicious. As more YARA rules are matched, the rule with the highest weight is used. If no weight is provided for a YARA rule, the default YARA weight is used.
Alerts are generated when the YARA rule match weight reaches 100. You can also set riskware policy rules to generate riskware alerts when weights are between 0 and 99.
Yara matching
Considerations
Yara matching can be a CPU-intensive operation, depending on the number of rules used and the amount of content they run against. If you intend to run a lot of rules against unfiltered content (e.g., 100 rules against every file in c:\windows) you should either test the performance locally or start by running the audit on a limited number of systems. Trellix recommends enabling fast Yara scanning. You may also want to specify a PyDEXCPULimit to limit maximum CPU usage on endpoints.
Yara matching relies on Python to read file contents when using the files-api audit. The SleuthKit is used to read raw-file audits.
There are important forensic limitations to FLP:
Timestamp preservation is not supported when Yara scanning is enabled. Running this audit in API mode with Yara matching enabled updates each file's last accessed timestamp. This will not occur in RAW mode.
Yara matching supports alternative data streams - FLP will automatically enumerate and perform Yara matching on any alternative data streams associated with matched files.
Note
Path prefixes are required to search files with non-standard names (e.g.
search\.\c:\Windowsinstead ofc:\Windows).Large files are read in chunks. When RAW mode is used, files will be read in 32MB chunks to prevent excessive memory usage. This can cause signatures to fail if the defined memory level is exceeded.