Intelligent Sandbox applies the Custom Behavioral Rules on the User API log of an analyzed sample. To create Custom Behavioral Rules to catch a specific behavior, you can use the user API log of a sample that caused the same behavior. You can use YARA rules to catch runtime DLLs, file operations, registry operations, process operations, and other operations reported in analysis summary report for a sample. For example, to catch a specific runtime DLL, see a sample's user API log and write a YARA rule for that DLL.
You are familiar with all features of Custom Behavioral Rules that Intelligent Sandbox currently supports.
You have identified the user API log of the sample that you want to use as a reference for creating your Custom Behavioral Rules.
Create a text file and open it in a text editor such as Windows Notepad.
Enter the comments in the text file to track the APIs or data that are the sources for your Custom Behavioral Rules.
Write the first rule and provide it a name.
Enter the metadata for the rule.
Metadata is mandatory for standard rules and optional for helper rules. Regarding custom YARA rules, metadata can contain classification, description, and severity. Use a [metadata field name] = [string/value] format to define all these three metadata fields. These fields are case-insensitive.
Optionally, enter the classification value for Custom Behavioral Rules. Classification is the malware classification category to which a behavioral rule belongs. Use the following information to calculate the classification value.
Classification
Value
Persistence, Installation Boot Survival
1
Hiding, Camouflage, Stealthiness, Detection and Removal Protection
2
Security Solution / Mechanism bypass, termination and removal, Anti Debugging, VM Detection
4
Spreading
8
Exploiting, Shellcode
16
Networking
32
Data spying, Sniffing, Keylogging, Ebanking Fraud
64
For example, if a YARA rule describes a malware that attempted to do spreading (value 8), installation boot survival (value 1), and networking (value 32) then total classification result is 8+1+32 = 41.
Enter the description for the rule, which is displayed in the analysis reports.
Enter a severity value for the behavior described by the YARA rule.
Severity value must be an integer from 1–5, with 5 indicating most malicious behavior. Severity values are irrelevant for helper rules.
Log on the Intelligent Sandbox web interface.
Click → , click
, then select User API Log.On the text editor, enter the strings and conditions according to YARA syntax.
Add more rules according to your requirement in the same custom YARA text file, then save the file.