YARA Rules

Tamandua EDR uses YARA rules for fast, signature-based detection of malware and threats. YARA rules enable pattern matching in files and memory. They are deterministic, but their false positive rate depends on rule quality, sample coverage, and validation against benign software.

Built-in Rule Sets

Tamandua currently ships with 15 built-in YARA files containing 233 rule definitions. These built-in files live under priv/yara_rules and are shown as read-only rules in the console. Custom YARA rules imported through the API or UI are stored separately in the database.

Rule Sources and Maturity

The current built-in pack is authored and curated by the Tamandua team with MITRE metadata and selected external references such as Malpedia and public research on syscall evasion and BYOVD tradecraft.

For production use, Tamandua treats this pack as a starting point, not a final commercial corpus. Mature deployments should add validated sources such as SigmaHQ-compatible detections, curated YARA feeds, internal malware analysis, and organization-specific threat intelligence.

Planned improvements:

• Provenance, license, and confidence metadata per rule
• Benchmark validation against Atomic Red Team, Caldera, GOAD and benign software
• False-positive scoring before enabling blocking behavior
• Signed detection packs with review status
• Optional import pipelines for selected public YARA collections

Example Rules

Ransomware Detection

rule Ransomware_Shadow_Copy_Deletion
{
    meta:
        description = "Detects attempts to delete Windows shadow copies"
        author = "Tamandua Security Team"
        severity = "critical"
        mitre_attack = "T1490"

    strings:
        $vss1 = "vssadmin delete shadows" ascii wide nocase
        $vss2 = "vssadmin.exe delete shadows" ascii wide nocase
        $vss3 = "wmic shadowcopy delete" ascii wide nocase
        $vss4 = "bcdedit /set {default} recoveryenabled no" ascii wide nocase
        $vss5 = "bcdedit /set {default} bootstatuspolicy ignoreallfailures" ascii wide nocase
        $vss6 = "wbadmin delete catalog" ascii wide nocase

    condition:
        any of them
}

Ransomware Family Detection

rule Ransomware_LockBit
{
    meta:
        description = "Detects LockBit ransomware"
        author = "Tamandua Security Team"
        severity = "critical"
        family = "LockBit"
        mitre_attack = "T1486"

    strings:
        $lb1 = "LockBit" ascii wide nocase
        $lb2 = "lockbit" ascii wide
        $lb3 = "Restore-My-Files.txt" ascii wide
        $lb4 = ".lockbit" ascii wide
        $lb5 = ".abcd" ascii wide
        $lb6 = "http://lockbit" ascii wide

        $code1 = { 8B 45 ?? 33 45 ?? 89 45 ?? 8B 4D ?? 33 4D ?? }
        $code2 = { C7 45 ?? 6B 00 63 00 C7 45 ?? 6F 00 6C 00 }

    condition:
        (2 of ($lb*)) or (1 of ($lb*) and 1 of ($code*))
}

Cryptographic API Usage

rule Ransomware_Crypto_API_Usage
{
    meta:
        description = "Detects suspicious cryptographic API usage patterns"
        author = "Tamandua Security Team"
        severity = "high"
        mitre_attack = "T1486"

    strings:
        $api1 = "CryptAcquireContext" ascii
        $api2 = "CryptGenRandom" ascii
        $api3 = "CryptEncrypt" ascii
        $api4 = "CryptImportKey" ascii
        $api5 = "BCryptOpenAlgorithmProvider" ascii
        $api6 = "BCryptGenerateSymmetricKey" ascii
        $api7 = "BCryptEncrypt" ascii

        $file1 = "FindFirstFile" ascii
        $file2 = "FindNextFile" ascii
        $file3 = "SetFilePointer" ascii
        $file4 = "WriteFile" ascii
        $file5 = "MoveFileEx" ascii

    condition:
        (3 of ($api*)) and (3 of ($file*))
}

Rule Syntax Reference

Basic Structure

rule RuleName
{
    meta:
        description = "Rule description"
        author = "Author name"
        severity = "critical|high|medium|low"
        mitre_attack = "T1XXX"
        family = "malware_family"
        hash = "sample_hash"
        reference = "URL"

    strings:
        $string1 = "text pattern" ascii wide nocase
        $hex1 = { 4D 5A 90 00 }
        $regex1 = /pattern[0-9]+/i

    condition:
        any of them
}

String Modifiers

Hex Patterns

strings:
    // Exact bytes
    $hex1 = { 4D 5A 90 00 }

    // Wildcards (any byte)
    $hex2 = { 4D 5A ?? 00 }

    // Jumps (variable length)
    $hex3 = { 4D 5A [2-4] 00 }

    // Alternatives
    $hex4 = { 4D 5A (90 | 91 | 92) 00 }

    // Negation
    $hex5 = { 4D 5A ~00 }

Conditions

condition:
    // Boolean operators
    $s1 and $s2
    $s1 or $s2
    not $s1

    // Counting
    2 of ($s*)
    all of them
    any of ($hex*)
    #s1 > 5  // String count

    // Position
    $s1 at 0
    $s1 in (0..100)

    // File size
    filesize < 100KB
    filesize > 1MB

    // PE module
    pe.imports("kernel32.dll", "VirtualAlloc")
    pe.sections[0].name == ".text"
    pe.number_of_sections > 5

Custom Rule Upload

Via API

# Upload a custom YARA rule
curl -X POST "https://api.tamandua.io/v1/rules/yara" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/x-yara" \
  -d @custom_rule.yar

Response:

{
  "id": "custom_12345",
  "name": "Custom_Detection_Rule",
  "status": "active",
  "validation": {
    "syntax_valid": true,
    "performance_score": 95,
    "estimated_fp_rate": "low"
  }
}

Via Dashboard

1. Navigate to Detection > Rules > YARA
2. Click Add Custom Rule
3. Paste or upload your YARA rule
4. Click Validate to check syntax
5. Click Deploy to activate

Via CLI

# Add custom rule
tamanduactl rules yara add custom_rule.yar

# Validate rule syntax
tamanduactl rules yara validate custom_rule.yar

# List custom rules
tamanduactl rules yara list --custom

Rule Testing

Test Against Sample

# Test rule against a file
tamanduactl rules yara test \
  --rule custom_rule.yar \
  --file suspicious.exe

Output:

Rule: Custom_Detection_Rule
File: suspicious.exe
Result: MATCH

Matches:
  $s1: offset 0x1234, "suspicious_string"
  $s2: offset 0x5678, "another_pattern"

Test Against Hash

# Test against known sample by hash
tamanduactl rules yara test \
  --rule custom_rule.yar \
  --hash sha256:abc123...

Batch Testing

# Test rule against sample collection
tamanduactl rules yara test-batch \
  --rule custom_rule.yar \
  --samples /path/to/samples/ \
  --output results.json

Rule Performance

Performance Metrics

Each rule is assigned a performance score based on:

Performance Tiers

Optimization Tips

1. Use specific strings - Avoid short or common strings

   // Bad
   $s = "cmd" ascii

   // Good
   $s = "cmd.exe /c" ascii fullword
   

1. Limit wildcards - Reduce wildcard usage in hex patterns

   // Bad
   $hex = { ?? ?? ?? ?? 4D 5A }

   // Good
   $hex = { 4D 5A 90 00 03 00 }
   

1. Use fullword modifier - Reduce false positives

   $s = "evil" fullword ascii
   

1. Combine conditions efficiently

   // Bad
   condition:
       $s1 and ($s2 or $s3 or $s4 or $s5)

   // Good
   condition:
       $s1 and 1 of ($s2, $s3, $s4, $s5)
   

Rule Management

Listing Rules

# List all YARA rules
tamanduactl rules yara list

# Filter by category
tamanduactl rules yara list --category ransomware

# Filter by status
tamanduactl rules yara list --status enabled

Enabling/Disabling Rules

# Disable a rule
tamanduactl rules yara disable Ransomware_Generic

# Enable a rule
tamanduactl rules yara enable Ransomware_Generic

# Disable entire category
tamanduactl rules yara disable --category lolbins

Rule Updates

# Check for rule updates
tamanduactl rules yara check-updates

# Update rules
tamanduactl rules yara update

# View update history
tamanduactl rules yara history

Scanning Configuration

Real-time Scanning

# Agent configuration
yara:
  enabled: true

  # Scan triggers
  scan_on_write: true
  scan_on_execute: true
  scan_on_open: false

  # File types to scan
  scan_extensions:
    - exe
    - dll
    - scr
    - bat
    - ps1
    - vbs
    - js

  # Exclusions
  exclude_paths:
    - C:\Windows\WinSxS\*
    - /var/cache/*

  exclude_signers:
    - "Microsoft Corporation"
    - "Google LLC"

Memory Scanning

yara:
  memory_scan:
    enabled: true
    interval: 300  # seconds
    target_processes:
      - type: "elevated"
      - type: "network_active"
      - type: "suspicious_parent"

Scheduled Scans

yara:
  scheduled_scan:
    enabled: true
    schedule: "0 2 * * *"  # Daily at 2 AM
    paths:
      - C:\Users\*\Downloads
      - C:\Users\*\Desktop
      - /tmp
      - /home/*/Downloads

API Reference

List Rules

GET /api/v1/rules/yara

# Response
{
  "rules": [
    {
      "id": "ransomware_001",
      "name": "Ransomware_Shadow_Copy_Deletion",
      "category": "ransomware",
      "severity": "critical",
      "enabled": true,
      "performance_score": 95
    }
  ],
  "total": 90
}

Get Rule Details

GET /api/v1/rules/yara/{id}

# Response
{
  "id": "ransomware_001",
  "name": "Ransomware_Shadow_Copy_Deletion",
  "content": "rule Ransomware_Shadow_Copy_Deletion { ... }",
  "meta": {
    "description": "Detects attempts to delete Windows shadow copies",
    "mitre_attack": "T1490"
  },
  "stats": {
    "total_matches": 150,
    "last_match": "2025-01-15T10:30:00Z",
    "false_positives": 2
  }
}

Create Rule

POST /api/v1/rules/yara
Content-Type: application/x-yara

rule Custom_Rule { ... }

# Response
{
  "id": "custom_12345",
  "status": "active",
  "validation": {
    "syntax_valid": true,
    "performance_score": 85
  }
}

Scan File

POST /api/v1/scan/yara
Content-Type: multipart/form-data

file=@suspicious.exe

# Response
{
  "matches": [
    {
      "rule": "Ransomware_Shadow_Copy_Deletion",
      "severity": "critical",
      "strings": [
        {"identifier": "$vss1", "offset": 1234, "data": "vssadmin delete shadows"}
      ]
    }
  ]
}

Related Documentation

• Detection Overview - Multi-layered detection strategy
• Sigma Rules - Log-based detection
• MITRE Coverage - ATT&CK technique mapping