SANS ISC: YARA: XOR Strings - SANS Internet Storm Center

• SANS Site Network
  • Current Site
  • Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

Hello,
I guess something like this might be usefull:

rule xor_dll_injection_imports : feature obfuscation
{
meta:
author = "Michal Ambroz"
description = "Detects API used for DLL injection obfuscated by single-byte xor"

strings:
$api_01 = "OpenProcess" xor
$api_02 = "GetProcessAddress" xor
$api_03 = "VirtualAllocEx" xor
$api_04 = "WriteProcessMemory" xor
$api_05 = "GetModuleHandleA" xor
$api_06 = "LoadLibraryA" xor
$api_07 = "CreateRemoteThread" xor
$api_08 = "VirtualProtect" xor
$api_09 = "advapi32.dll" xor

condition:
//Contains all of the strings
any of them
}

Thank you Didier - I havn't noticed this functionality so far.

It is just pity that the --print-strings displays only the match and not the original string.
For example:

$ cat win_obfuscated_calls.yara
rule xor_dll_injection_imports : feature obfuscation
{
meta:
author = "Michal Ambroz"
description = "Detects API used for DLL injection obfuscated by single-byte xor"

strings:
$api_01 = "OpenProcess" xor
$api_02 = "GetProcessAddress" xor
$api_03 = "VirtualAllocEx" xor
$api_04 = "WriteProcessMemory" xor
$api_05 = "GetModuleHandleA" xor
$api_06 = "LoadLibraryA" xor
$api_07 = "CreateRemoteThread" xor
$api_08 = "VirtualProtect" xor
$api_09 = "advapi32.dll" xor

condition:
//Contains any of the strings
any of them
}

$ yara -s win_obfuscated_calls.yara 8ac1a9d4a9b6f0fc23d481e0db29de18bf596071418611c52a0bd0942103776a
0x2bc34:$api_08: Lshno{vJhun\x7Fyn
0x2bd80:$api_08: Lshno{vJhun\x7Fyn
0x2c414:$api_08: Lshno{vJhun\x7Fyn
0x2c5e8:$api_08: Lshno{vJhun\x7Fyn

So as a practical hint - it is usefull to name the strings in yara with something meaningfull:
$ cat win_obfuscated_calls.yara
rule xor_dll_injection_imports : feature obfuscation
{
meta:
author = "Michal Ambroz"
description = "Detects API used for DLL injection obfuscated by single-byte xor"

strings:
$api_OpenProcess = "OpenProcess" xor
$api_GetProcessAddress = "GetProcessAddress" xor
$api_VirtualAllocEx = "VirtualAllocEx" xor
$api_WriteProcessMemory = "WriteProcessMemory" xor
$api_GerModuleHandleA = "GetModuleHandleA" xor
$api_LoadLibraryA = "LoadLibraryA" xor
$api_CreateRemoteThread = "CreateRemoteThread" xor
$api_VirtualProtect = "VirtualProtect" xor
$dll_advapi32_dll = "advapi32.dll" xor

condition:
//Contains any of the strings
any of them
}

$ yara -s win_obfuscated_calls.yara 8ac1a9d4a9b6f0fc23d481e0db29de18bf596071418611c52a0bd0942103776a
xor_dll_injection_imports 8ac1a9d4a9b6f0fc23d481e0db29de18bf596071418611c52a0bd0942103776a
0x2bc34:$api_VirtualProtect: Lshno{vJhun\x7Fyn
0x2bd80:$api_VirtualProtect: Lshno{vJhun\x7Fyn
0x2c414:$api_VirtualProtect: Lshno{vJhun\x7Fyn
0x2c5e8:$api_VirtualProtect: Lshno{vJhun\x7Fyn

Michal Ambroz

So you know of any speed baseline tests done against this option?

Minor point: there is a missing "+" in the first regular-expression example. After adding the "+", I was able to duplicate everything. I went to <https://yara.readthedocs.io/en/v3.8.1/writingrules.html>, and it didn't seem to mention xor not working with non-literal regular expressions. I am guessing a regular expression that can be treated as a string works as a string, so xor would work then. I think the documentation should clarify the intent.

No. And in general, I don't know of any public, extensive performance tests.
I've tried to do this before, and a lot of parameters have an impact. I'll try to summarize it in a diary entry.

Thanks for pointing out to typo robv, I fixed it.

The YARA documentation only mentions string modifier xor for strings, not for regular expressions.
Hence I expected an error message when I would use it with a regex, but that is not the case.