Let's start writing Yara rules by writing a rule to flag malware originating from the most famous IoT botnet ever : Mirai.
Mirai is known to have paralyzed the whole Internet in northern america in 2016 by attacking the DNS provider DynDNS.
And it is still alive to this day, searching online for new IoT and GNU/Linux devices to recruit in the botnet!

In the terminal (that can be opened by clicking the Open Terminal button), you can access a /malware directory containing uncategorized malware.

In this lab, we'll learn to categorize specific malware pieces using yara.
Yara uses a simple rules syntax that you will likely quickly learn!

Using nano, emacs or vim create a new mirai.yara file and then write the following contents inside:

rule MiraiBot {

  meta:
    description = "Mirai Botnet Malware"

  strings:
    $ua = "USER-AGENT: Google Chrome/60.0.3112.90 Windows"
    $snquery = "SNQUERY: 127.0.0.1:AAAAAA:xsvr"

  condition:
    $ua and $snquery
}
Then, look for matches of your yara rule in the /malware directory using yara -r mirai.yara /malware.
If you copied everything correctly, a flag should be given to you!

We correctly identified one version of the Mirai bot! But how did we do it?
In the strings section we selected two strings which were part of the bot sample.
Then, in the conditions section, we defined that both of the strings $ua and $snquery had to be present in an analyzed file for it to be flagged as MiraiBot.

Those strings have been found using the strings command-line tool: strings -n 8 /malware/83d0db3cb080a299c5527d105bde46624c6fa69021e3067ed01b0ec84f7a6d28.elf
Using the same techniques, edit your existing mirai.yara rule to also match the file starting with 05ff05[...] (which actually is another variant of the Mirai bot).
Select a string that is unlikely to be in another executable to avoid false positives.

💡Hint: the parameter -n 8 tells strings to look for strings of at least 8 characters! Feel free to change this in your own tests. Also, remember that you can use or in your yara rule...

Run yara -r mirai.yara /malware, if your rule works as expected, you will get a flag!

What if I told you that there's another third Mirai sample in the /malware directory?

But this one is a more modern and stealthy version of the bot, it contains no identifiable character string!
You will have to use something else to flag this one, some of the executable file's bytes in a hexadecimal representation, to be precise!
Edit your yara rule to match the following bytes : 56 59 50 52 5a 52 00 66

Run yara -r mirai.yara /malware, if your rule works as expected, you will get a flag!

💡Hint: Remember that you can look at the rules documentation.

Now that we're done with Mirai, let's work with samples of the most infamous botnet in history : WannaCry!

This time, you're on your own, the two malware samples that you need to write a rule for are :
/malware/51d3aa054c3c98e25e973f16a75b267b1b4823cb5edd9ba0fedd85f12a44567c.exe
and
/malwares/716954bdf4ef6882a71c8f2aa3981190da7777b50a3988069bb68eed17c7ddc8.dll

Those are two WannaCry samples, using strings, rabin2 or radare2 depending on your preference, have a look at the contents of these files and find a way to identify and flag them while avoiding false positives.

Create a new rule named WannaCry and run yara -r wannacry.yara /malware, if your rule works as expected, you will get a flag!

💡Hint: If you have trouble writing this one, you can take inspiration from the official CISA post about this malware campaign.

AgentTesla is a more modern malware (trojan) campaign, which started in 2020.

This time, a wider variety of samples for this malware are available,
let's start by writing a rule to match the first kind of IoC available : a windows binary :
/malware/00acb9001a79a01c5d9c778358ee84d4c805f3c8e9c90e2c4df0601628911768.exe

Write a AgentTesla rule and run it with yara against the /malware directory to test it! If it works correctly, a flag will be displayed.

The second file type is also a windows binary :
/malware/c4a1185ba8820bbbf9dd7945dcd223006146667df2fb49dd789f09fa99982502.exe

Edit your AgentTesla rule to match this file as well and run it with yara against the /malware directory to test it! If it works correctly, a flag will be displayed.

This one is a different file, it's a Powershell script! :
/malware/8655c1e88ac5da92b7f5f6713fc76c28b1b625f5d50aeea0aa511bdff8d4c964.ps1

Edit your AgentTesla rule to match this file as well and run it with yara against the /malware directory to test it! If it works correctly, a flag will be displayed.

Did you know that Windows can run JScript files?! Here's another AgentTesla for you to include :
/malware/3a984f61476288951933e3a9917c8593082347e7257ac515165da1a81039c4be.js

Edit your AgentTesla rule to match this file as well and run it with yara against the /malware directory to test it! If it works correctly, a flag will be displayed.