Class 1 Lab 3 ‐ Creating YARA Rules - Justin-Boyd/CIT-Class GitHub Wiki

Task 1: Scan for Infection

Step 1

  • Copy the provided file HiWorld.zip to the Downloads folder in the Windows 10 VM.

Step 2

  • Right-click the file HiWorld.zip, and select Extract Here.

Step 3

  • In your Windows 10 VM, search for Windows PowerShell in the search bar and run it as an administrator.

Step 4

  • Click Yes for the request to make changes.

Step 5

  • Use cd C:\Users<user>\Downloads\clamav-0.102.2-win-x86-pertable\ to navigate to the ClamAV directory.

Step 6

  • Use the command ./clamscan.exe -v C:\Users<user>\Downloads\HiWorld.exe to scan the executable.

Task 2: HxD Installation

Step 1

  • Copy the provided file HxDSetup.zip to the Downloads folder in the Windows 10 VM.

Step 2

  • Right-click the file HxDSetup.zip, and select Extract Here.

Step 3

  • Double-click the file HxDSetup to begin the installation of the HxD hex editor. When asked for permission to make changes, click Yes.

Step 4

  • Select the English language and click OK.

Step 5

  • Click Next in the first setup page.

Step 6

  • Accept the agreement and click Next.

Step 7

  • Select the installation destination and click Next.

Step 8

  • In the Start Menu Folder Selection window, don’t change anything and click Next.

Step 9

  • Select Create a desktop shortcut and click Next.

Step 10

  • Click Install.

Step 11

  • Deselect both options, and click Finish.

Task 3: Creating a YARA Rule

Step 1

  • Open the Downloads folder and run the executable HiWorld.exe.

Step 2

  • From the displayed content, which words can potentially be used for the creation of the YARA rule?
    • There are many options to choose from. For example, "Hello Class!" can be used, or "Create a YARA rule", and many others.

Step 3

  • Double-click HxD to start it.

Step 4

  • Click File, and select Open…

Step 5

  • Navigate to the Downloads folder, select the executable HiWorld.exe, and click Open.

Step 6

  • Press Ctrl + f, type "Create a YARA rule", select the search direction All, and click OK.

Step 7

  • Note that the searched text is highlighted. Right-click its hex values, and select Copy.

Step 8

  • Double-click Notepad++

Step 9

  • In the file, write the following text (replace with the copied value): 
rule HiWorld
{
 strings:
 $text_string = "Create a YARA rule"
 $hex_string = { <hex> }
 condition:
 $text_string or $hex_string
}

Step 10

  • Click File and select Save As.

Step 11

  • Navigate to Downloads \clamav-0.102.2-win-x86-portable \database and save the file with the name hiworld.yar.
  • Note: Make sure to have file extension enabled

Step 12

  • In PowerShell, execute the following command to scan the executable HiWorld.exe.:
./clamscan.exe -v C:\Users\<user>\Downloads\HiWorld.exe
  • Note that the scan marked the file as infected

Step 13

  • Use the command again but with the flag –remove:
./clamscan.exe -v C:\Users\<user>\Downloads\HiWorld.exe --remove
  • This will automatically remove the infected file

Step 14

  • Go to the Downloads directory and verify that the file was removed.
⚠️ **GitHub.com Fallback** ⚠️