Detecting Malicious Files with YARA Rules as They Traverse the Network

Presented at Black Hat USA 2019, Aug. 7, 2019, 5:05 p.m. (25 minutes)

YARA, the pattern matching swiss knife for malware researchers, has been extremely useful at detecting suspicious files on the endpoint. However, little or no information is publicly available on how to leverage this useful tool to scan for files as they are traversing the network.

In this presentation, I will show how you can open source Zeek IDS (formerly bro) and how some custom developed scripts can be used to extract files from the network and identify attacks on an early stage before it causes more damage. Scanning for YARA files on the network has the benefit of increased performance, as compared to scanning several gigabytes or terabytes on the endpoint, as well as target specific mime types, used for malware delivery. Additionally, Zeek IDS can provide additional context whenever a YARA rule is triggered, that will provide defenders with more information to act more rapidly.

Presenters:

• David Bernal - Lead Security Researcher, SCILabs - Scitum
  David Bernal Michelena has 10 years of experience in information security and holds a bachelor's degree in Computer Engineering from the National Autonomous University of Mexico (UNAM). Since June 2015, he has served as a cyber security researcher in a Cyber Security Team in Scitum, a large consultant company in Mexico and Latin America. David's main activities are malware analysis, cyber threat intelligence, digital forensics, validation of security technologies and writing and testing various detection rules to better protect the customers. David holds the following industry certifications: GREM, GCFA, GCFE, GCTI, GCIA, GASF, GXPN. In his free time, he likes to swim and play the piano

Links:

• https://www.blackhat.com/us-19/briefings/schedule/#detecting-malicious-files-with-yara-rules-as-they-traverse-the-network-16221
• https://infocon.org/cons/Black Hat/Black Hat USA/Black Hat USA 2019/Detecting Malicious Files with YARA Rules as They Traverse the Network.mp4
• https://infocon.org/cons/Black Hat/Black Hat USA/Black Hat USA 2019/Detecting Malicious Files with YARA Rules as They Traverse the Network.en.transcribed.srt (subtitles)
• https://www.youtube.com/watch?v=irai0kk942E

Similar Presentations:

• BSidesLV 2017 / Effective YARA
• BSidesDC 2017 / Effective YARA (CLASS)
• SAINTCON 2019 / Becoming the YARA Hunter Training