YARA IOC 扫描与威胁狩猎

---
name: yara-hunting
description: Conduct defensible IOC sweeps and malware-oriented threat hunting with YARA on SANS SIFT, including rule construction, PE/hash/entropy logic, recursive file and memory scanning, false-positive testing, compiled rules, hit triage, and optional Velociraptor endpoint hunting concepts.
---

# YARA Threat Hunting

Use this skill for IOC sweeps, malware triage and threat hunting across forensic exports, mounted evidence and memory images. YARA matches are leads, not final attribution. Preserve the matched file, hash it, record the rule name and matched offsets, and corroborate the hit with other forensic evidence.

## Tools

Typical SIFT locations:

- `yara` — `/usr/local/bin/yara`
- `yarac` — `/usr/local/bin/yarac`

Velociraptor is treated separately as an endpoint hunting platform accessed through its console; do not assume it is a local SIFT binary.

## Rule design

A good YARA rule should be specific enough to reduce false positives and should document why the strings were chosen. Prefer several independent indicators over one generic string.

Example structure:

```yara
rule Example_Family
{
    meta:
        description = "Detects a confirmed indicator family"
        author = "Analyst"

    strings:
        $s1 = "distinctive_string" ascii wide nocase
        $s2 = { 48 8B ?? ?? 89 }

    condition:
        uint16(0) == 0x5A4D and
        filesize < 10MB and
        all of them
}
```

Use wildcarded byte patterns only where the variable bytes are understood. Avoid copying long generic strings that appear in legitimate software.

## Useful modules and conditions

For PE files, the `pe` module can constrain rules by imports, sections, version information, export structure or `imphash()`. The `math` module can support entropy checks, and the `hash` module can match a known file hash when that is genuinely the intended IOC.

Put inexpensive checks first so large hunts fail fast:

1. header or file-type check
2. file-size constraint
3. PE/module property
4. string/byte matches
5. expensive entropy or broad regex logic

High entropy alone is not malicious; many compressed, encrypted or packed legitimate files are high entropy.

## Scan workflows

Single file:

```bash
yara /path/to/rules.yar /path/to/file
```

Recursive directory scan:

```bash
yara -r /path/to/rules.yar ./exports/files/
```

Show matched strings and offsets:

```bash
yara -r -s /path/to/rules.yar ./exports/files/ 2>/dev/null | tee ./exports/yara_hits/hits.txt
```

Scan a memory image:

```bash
yara /path/to/rules.yar /path/to/memory.img
```

For large rule sets, compile them first:

```bash
yarac rules.yar compiled.rules
yara -C compiled.rules /target/path/
```

Use thread, timeout, tag and fast-scan options when appropriate for the installed YARA version. Avoid following symlinks during recursive scans unless the target layout is fully understood.

## IOC sweep method

1. Build the IOC set from confirmed evidence: hashes, stable strings, paths, mutexes, byte sequences or other defensible characteristics.
2. Write rules by indicator family rather than mixing unrelated behaviors into one rule.
3. Test against a clean or representative corpus before the evidence sweep.
4. Scan forensic exports and mounted evidence read-only.
5. Scan memory when the rule is suitable for process or image content.
6. For each hit, capture rule name, file path, offsets, matched strings and file hash.
7. Triage the matching file independently.
8. Correlate hits with process, filesystem, timeline, registry and network artifacts.
9. Revise noisy rules and rerun while preserving prior results.

## False-positive testing

Test every new or substantially changed rule before using it at scale. A rule that matches common system binaries or large clean directories without a clear reason needs refinement.

```bash
yara -r rules.yar /path/to/known-clean/ 2>/dev/null
```

Do not weaken a rule merely to produce more hits; the goal is discriminative evidence, not volume.

## Community rules

Community YARA repositories can provide useful starting points, but treat external rules as third-party code/data. Record the source and version, inspect the rule before use, and pin or archive the exact rule set used in the case. Do not automatically fetch and execute a mutable remote ruleset during evidence analysis.

## Velociraptor hunting concepts

Where an authorized Velociraptor deployment exists, equivalent hunts can be scaled across endpoints using artifacts for process listing, Autoruns, network connections, Prefetch, MFT, EVTX and YARA scanning. Keep the endpoint scope explicit and separate live-response conclusions from offline evidence conclusions.

## Reporting

For every significant YARA hit, report:

- rule and rule-set version
- evidence path and hash
- matching offsets/strings where appropriate
- scan date/time and scope
- whether the rule was tested against a clean corpus
- independent corroborating artifacts
- any known false-positive limitations

Store raw scan output under `./exports/yara_hits/` and put analyst conclusions in the case report rather than editing the raw hit file.