Malware › Module 5 › Lesson 4
Lab — YARA
Pack YARA literacy — use cases, rule skeleton, FP checklist — literacy file only, dest $MAL_LAB.
Visual · mal_yara_lab
Lab: write YARA pack. $MAL_LAB only. Original Cyberlium.
Opening
YARA pack before production handoff — anatomy and FP testing on paper first.
Lessons 5-1 through 5-3 covered YARA naming, rule anatomy, and false positives. This lab merges them into one YARA literacy pack for $MAL_LAB linked to M4 IOC strings. Optional: draft rule skeleton using placeholder strings from public report — no live sample required. No unauthorized scanning. Next: Quiz — YARA Literacy.
1. Lab contract: write the YARA pack
Create $HOME/cyberlium-lab/t22-m05-l04-yara-lab.txt merging use cases, rule skeleton, FP checklist, and link to M4 strings/hash pack.
Optional: yara rule.yar on static copy of legal training sample in $MAL_LAB — if infra available.
Command guide
Try these commands — Lab contract: write the YARA pack
═══ LINUX / macOS / WINDOWS (YARA Analysis) ═══
Create a sample detection rule for suspicious downloader artifacts
Command — copy this
cat << 'EOF' > detect_suspicious.yar
rule Suspicious_Downloader_Artifact {
meta:
description = "Detects PowerShell web download patterns and executable headers"
author = "Cyberlium SOC Analyst"
date = "2026"
strings:
$mz = { 4D 5A }
$s1 = "DownloadString" nocase
$s2 = "WebClient" nocase
$s3 = "powershell -enc" nocase
condition:
$mz at 0 and (any of ($s*))
}
EOFCompile and validate the YARA rule against a file or folder
Command — copy this
yara -w detect_suspicious.yar /path/to/sample.bin
Primary tools to practice this lesson: yara, strings. Reference sites: YARA performance (https://yara.readthedocs.io/en/stable/writingrules.html); ANY.RUN YARA hits (https://any.run/); VirusTotal YARA (https://www.virustotal.com/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check offensive YARA misuse
Grep for FUD, evasion, unauthorized scan language — delete. Tutorials teaching AV bypass get rewritten to defender detection skeleton only.
Classmates write their own YARA packs for their $MAL_LAB.
3. Lock the proof
chmod 600 on the pack. Quiz next — then Dynamic Analysis Basics.
YARA literacy feeds dynamic sandbox module — static rules plus behavior.
4. What you ship: YARA literacy pack for $MAL_LAB
Use cases + rule skeleton + FP checklist merged. $MAL_LAB named. No evasion offense. chmod 600.
5. What you record before the next lesson
Date. YARA pack path. $MAL_LAB named. File t22-m05-l04-yara-lab.txt chmod 600.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Add AV evasion rule to pack. Scan production without authorization.
Right
Write YOUR YARA literacy pack for $MAL_LAB. chmod 600. Next: Quiz — YARA Literacy.
Mission: freeze YOUR YARA pack on disk
1) Merge M5 literacy sections. 2) Link M4 strings/hash pack. 3) chmod 600. Never include evasion or unauthorized scan steps.
Stuck? Ask Cyberlium AI Mentor
YARA packs bridge static IOCs and detection engineering.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: YARA pack should include FP test checklist.
True or False
Knowledge Check
APPLY: Rule skeleton meta should include:
Multiple choice