# Hunting Evil with YARA (Linux Edition)

### Overview

When direct access to a system is restricted, memory captures can still allow us to investigate potential threats. By using YARA on these memory snapshots, Security Analysts can scan for indicators of compromise even when the system itself remains inaccessible.

#### Key Process:

1. **Create YARA Rules**: Develop rules targeting memory-based malware traits or suspicious behaviors.
2. **Compile Rules**: Using `yarac`, compile YARA rules to `.yrc` binary format (optional for better performance).
3. **Capture Memory Image**: Use tools like DumpIt, MemDump, Belkasoft RAM Capturer, Magnet RAM Capture, FTK Imager, or LiME (Linux Memory Extractor).
4. **Scan Memory Image with YARA**: Run YARA on the memory image to detect matches.

#### Example Memory Scan with YARA

* **Memory Image**: `compromised_system.raw` from `/home/htb-student/MemoryDumps`.
* **YARA Rule File**: `wannacry_artifacts_memory.yar` located in `/home/htb-student/Rules/yara`.

```
yara /home/htb-student/Rules/yara/wannacry_artifacts_memory.yar /home/htb-student/MemoryDumps/compromised_system.raw --print-strings
```

#### Sample Output:

Detected patterns related to WannaCry ransomware, such as `tasksche.exe` and other known artifacts.

#### Integrating YARA with Volatility for Memory Forensics

#### Volatility Framework

Volatility is a robust tool for analyzing memory images across multiple OS platforms. Using YARA within Volatility (via the `yarascan` plugin), Analysts can scan for specific malware indicators within the memory.

#### Example - Single Pattern Search

Searching for a specific hard-coded URI without a YARA file:

```
vol.py -f /home/htb-student/MemoryDumps/compromised_system.raw yarascan -U "www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com"
```

* **Output**: Finds occurrences of this URI within the memory image.

#### Example - Multiple Rule Scanning

Applying a set of YARA rules using the `-y` option with Volatility:

```
vol.py -f /home/htb-student/MemoryDumps/compromised_system.raw yarascan -y /home/htb-student/Rules/yara/wannacry_artifacts_memory.yar
```

**Sample YARA Rule for WannaCry**

```
rule Ransomware_WannaCry {
    meta:
        author = "Madhukar Raina"
        version = "1.1"
        description = "Detect strings from WannaCry ransomware"
        reference = "https://www.virustotal.com"

    strings:
        $wannacry_payload_str1 = "tasksche.exe" fullword ascii
        $wannacry_payload_str2 = "www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com" ascii
        $wannacry_payload_str3 = "mssecsvc.exe" fullword ascii
        $wannacry_payload_str4 = "diskpart.exe" fullword ascii
        $wannacry_payload_str5 = "lhdfrgui.exe" fullword ascii

    condition: 3 of them
}
```

* **Output**: Identifies specific WannaCry artifacts in the memory image.