Detecting Malware Using YARA Integration with Wazuh#

1
#!/bin/bash
2
# Wazuh - Yara active response
3
# Copyright (C) 2015-2022, Wazuh Inc.
4
#
5
# This program is free software; you can redistribute it
6
# and/or modify it under the terms of the GNU General Public
7
# License (version 2) as published by the FSF - Free Software
8
# Foundation.
9

10

11
#------------------------- Gather parameters -------------------------#
12

13
# Extra arguments
14
read INPUT_JSON
15
YARA_PATH=$(echo $INPUT_JSON | jq -r .parameters.extra_args[1])
16
YARA_RULES=$(echo $INPUT_JSON | jq -r .parameters.extra_args[3])
17
FILENAME=$(echo $INPUT_JSON | jq -r .parameters.alert.syscheck.path)
18

19
# Set LOG_FILE path
20
LOG_FILE="logs/active-responses.log"
21

22
size=0
23
actual_size=$(stat -c %s ${FILENAME})
24
while [ ${size} -ne ${actual_size} ]; do
25
    sleep 1
26
    size=${actual_size}
27
    actual_size=$(stat -c %s ${FILENAME})
28
done
29

30
#----------------------- Analyze parameters -----------------------#
31

32
if [[ ! $YARA_PATH ]] || [[ ! $YARA_RULES ]]
33
then
34
    echo "wazuh-yara: ERROR - Yara active response error. Yara path and rules parameters are mandatory." >> ${LOG_FILE}
35
    exit 1
36
fi
37

38
#------------------------- Main workflow --------------------------#
39

40
# Execute Yara scan on the specified filename
41
yara_output="$("${YARA_PATH}"/yara -w -r "$YARA_RULES" "$FILENAME")"
42

43
if [[ $yara_output != "" ]]
44
then
45
    # Iterate every detected rule and append it to the LOG_FILE
46
    while read -r line; do
47
        echo "wazuh-yara: INFO - Scan result: $line" >> ${LOG_FILE}
48
    done <<< "$yara_output"
49
fi
50

51
exit 0;

1
<syscheck>
2
  <directories realtime="yes">/tmp/yara/malware</directories>
3
</syscheck>

1
<syscheck>
2
  <directories realtime="yes">C:\Users\<USER_NAME>\Downloads</directories>
3
</syscheck>

1
<!-- YARA Decoders -->
2
<decoder name="yara_decoder">
3
  <prematch>wazuh-yara:</prematch>
4
</decoder>
5

6
<decoder name="yara_decoder1">
7
  <parent>yara_decoder</parent>
8
  <regex>wazuh-yara: (\S+) - Scan result: (\S+) (\S+)</regex>
9
  <order>log_type, yara_rule, yara_scanned_file</order>
10
</decoder>

1
<group name="syscheck,">
2
  <!-- Linux FIM rules -->
3
  <rule id="100300" level="7">
4
    <if_sid>550</if_sid>
5
    <field name="file">/tmp/yara/malware/</field>
6
    <description>File modified in /tmp/yara/malware/ directory.</description>
7
  </rule>
8

9
  <rule id="100301" level="7">
10
    <if_sid>554</if_sid>
11
    <field name="file">/tmp/yara/malware/</field>
12
    <description>File added to /tmp/yara/malware/ directory.</description>
13
  </rule>
14

15
  <!-- Windows FIM rules -->
16
  <rule id="100303" level="7">
17
    <if_sid>550</if_sid>
18
    <field name="file">C:\\Users\\<USER_NAME>\\Downloads</field>
19
    <description>File modified in C:\Users\<USER_NAME>\Downloads directory.</description>
20
  </rule>
21

22
  <rule id="100304" level="7">
23
    <if_sid>554</if_sid>
24
    <field name="file">C:\\Users\\<USER_NAME>\\Downloads</field>
25
    <description>File added to C:\Users\<USER_NAME>\Downloads directory.</description>
26
  </rule>
27
</group>
28

29
<group name="yara,">
30
  <rule id="108000" level="0">
31
    <decoded_as>yara_decoder</decoded_as>
32
    <description>Yara grouping rule</description>
33
  </rule>
34

35
  <rule id="108001" level="12">
36
    <if_sid>108000</if_sid>
37
    <match>wazuh-yara: INFO - Scan result: </match>
38
    <description>File "$(yara_scanned_file)" is a positive match. Yara rule: $(yara_rule)</description>
39
  </rule>
40
</group>

1
<ossec_config>
2
  <!-- Linux YARA command -->
3
  <command>
4
    <name>yara_linux</name>
5
    <executable>yara.sh</executable>
6
    <extra_args>-yara_path /usr/local/bin -yara_rules /tmp/yara/rules/yara_rules.yar</extra_args>
7
    <timeout_allowed>no</timeout_allowed>
8
  </command>
9

10
  <!-- Windows YARA command -->
11
  <command>
12
    <name>yara_windows</name>
13
    <executable>yara.bat</executable>
14
    <timeout_allowed>no</timeout_allowed>
15
  </command>
16

17
  <!-- Active Response configurations -->
18
  <active-response>
19
    <disabled>no</disabled>
20
    <command>yara_linux</command>
21
    <location>local</location>
22
    <rules_id>100300,100301</rules_id>
23
  </active-response>
24

25
  <active-response>
26
    <disabled>no</disabled>
27
    <command>yara_windows</command>
28
    <location>local</location>
29
    <rules_id>100303,100304</rules_id>
30
  </active-response>
31
</ossec_config>

1
#!/bin/bash
2
# Wazuh - Malware Downloader for test purposes
3
# Copyright (C) 2015-2022, Wazuh Inc.
4
#
5
# This program is free software; you can redistribute it
6
# and/or modify it under the terms of the GNU General Public
7
# License (version 2) as published by the FSF - Free Software
8
# Foundation.
9

10
function fetch_sample(){
11
  curl -s -XGET "$1" -o "$2"
12
}
13

14
echo "WARNING: Downloading Malware samples, please use this script with caution."
15
read -p "  Do you want to continue? (y/n)" -n 1 -r ANSWER
16
echo
17

18
if [[ $ANSWER =~ ^[Yy]$ ]]
19
then
20
    echo
21
    # Mirai
22
    echo "# Mirai: https://en.wikipedia.org/wiki/Mirai_(malware)"
23
    echo "Downloading malware sample..."
24
    fetch_sample "https://wazuh-demo.s3-us-west-1.amazonaws.com/mirai" "/tmp/yara/malware/mirai" && echo "Done!" || echo "Error while downloading."
25
    echo
26

27
    # Xbash
28
    echo "# Xbash: https://unit42.paloaltonetworks.com/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"
29
    echo "Downloading malware sample..."
30
    fetch_sample "https://wazuh-demo.s3-us-west-1.amazonaws.com/xbash" "/tmp/yara/malware/xbash" && echo "Done!" || echo "Error while downloading."
31
    echo
32

33
    # VPNFilter
34
    echo "# VPNFilter: https://news.sophos.com/en-us/2018/05/24/vpnfilter-botnet-a-sophoslabs-analysis/"
35
    echo "Downloading malware sample..."
36
    fetch_sample "https://wazuh-demo.s3-us-west-1.amazonaws.com/vpn_filter" "/tmp/yara/malware/vpn_filter" && echo "Done!" || echo "Error while downloading."
37
    echo
38

39
    # Webshell
40
    echo "# WebShell: https://github.com/SecWiki/WebShell-2/blob/master/Php/Worse%20Linux%20Shell.php"
41
    echo "Downloading malware sample..."
42
    fetch_sample "https://wazuh-demo.s3-us-west-1.amazonaws.com/webshell" "/tmp/yara/malware/webshell" && echo "Done!" || echo "Error while downloading."
43
    echo
44
fi

1
rule Ransomware_Generic
2
{
3
    meta:
4
        description = "Generic ransomware detection"
5
        author = "Security Team"
6
        date = "2024-01-01"
7
        severity = "high"
8

9
    strings:
10
        $ransom1 = "Your files have been encrypted" nocase
11
        $ransom2 = "Bitcoin" nocase
12
        $ransom3 = "decrypt" nocase
13
        $ransom4 = ".locked" nocase
14
        $crypto1 = "AES" nocase
15
        $crypto2 = "RSA" nocase
16

17
    condition:
18
        2 of ($ransom*) and 1 of ($crypto*)
19
}
20

21
rule Webshell_Detection
22
{
23
    meta:
24
        description = "Detects common webshells"
25
        author = "Security Team"
26

27
    strings:
28
        $php1 = "<?php" nocase
29
        $shell1 = "system(" nocase
30
        $shell2 = "exec(" nocase
31
        $shell3 = "shell_exec(" nocase
32
        $shell4 = "passthru(" nocase
33
        $eval = "eval(" nocase
34

35
    condition:
36
        $php1 and ($eval or 2 of ($shell*))
37
}

1
#!/bin/bash
2

3
RULES_DIR="/tmp/yara/rules"
4
TEMP_DIR="/tmp/yara_update"
5

6
# Create temp directory
7
mkdir -p $TEMP_DIR
8

9
# Download latest rules from multiple sources
10
echo "Downloading YARA rules..."
11

12
# Yara-Rules project
13
git clone https://github.com/Yara-Rules/rules.git $TEMP_DIR/yara-rules
14

15
# Neo23x0 signature base
16
git clone https://github.com/Neo23x0/signature-base.git $TEMP_DIR/signature-base
17

18
# Compile all rules
19
echo "Compiling rules..."
20
find $TEMP_DIR -name "*.yar" -o -name "*.yara" | while read rule; do
21
    yara -w $rule /dev/null 2>/dev/null && cp $rule $RULES_DIR/
22
done
23

24
# Cleanup
25
rm -rf $TEMP_DIR
26

27
# Restart Wazuh manager to reload rules
28
systemctl restart wazuh-manager
29

30
echo "YARA rules updated successfully"