Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] plyara parses invalid rule #124

Open
schrodyn opened this issue Apr 10, 2023 · 0 comments
Open

[BUG] plyara parses invalid rule #124

schrodyn opened this issue Apr 10, 2023 · 0 comments

Comments

@schrodyn
Copy link

I intentionally added an extra and to the condition in the following rule:

rule HackTool_MSIL_Rubeus_1_Wibble
{
    meta:
        description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public Rubeus project."
        md5 = "66e0681a500c726ed52e5ea9423d2654"
        reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
        author = "FireEye"
    strings:
        $typelibguid = "658C8B7F-3664-4A95-9572-A3E5871DFC06" ascii nocase wide
    condition:
        uint16(0) == 0x5A4D and $typelibguid and
}

Yara won't accept this rule as it's invalid:

$ yara /tmp/test.yar ~/Downloads/MALWARE
error: rule "HackTool_MSIL_Rubeus_1_Wibble" in /tmp/test.yar(12): syntax error, unexpected '}'

But plyara parses the rule without any errors:

$ plyara /tmp/test.yar
[
    {
        "condition_terms": [
            "uint16",
            "(",
            "0",
            ")",
            "==",
            "0x5A4D",
            "and",
            "$typelibguid",
            "and"
        ],
        "metadata": [
            {
                "description": "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public Rubeus project."
            },
            {
                "md5": "66e0681a500c726ed52e5ea9423d2654"
            },
            {
                "reference": "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
            },
            {
                "author": "FireEye"
            }
        ],
        "raw_condition": "condition:\n        uint16(0) == 0x5A4D and $typelibguid and\n",
        "raw_meta": "meta:\n        description = \"The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public Rubeus project.\"\n        md5 = \"66e0681a500c726ed52e5ea9423d2654\"\n        reference = \"https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html\"\n        author = \"FireEye\"\n    ",
        "raw_strings": "strings:\n        $typelibguid = \"658C8B7F-3664-4A95-9572-A3E5871DFC06\" ascii nocase wide\n    ",
        "rule_name": "HackTool_MSIL_Rubeus_1_Wibble",
        "start_line": 1,
        "stop_line": 12,
        "strings": [
            {
                "modifiers": [
                    "ascii",
                    "nocase",
                    "wide"
                ],
                "name": "$typelibguid",
                "type": "text",
                "value": "658C8B7F-3664-4A95-9572-A3E5871DFC06"
            }
        ]
    }
]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant