Malware › Module 5 › Lesson 4
Lab — YARA
Pack YARA literacy — use cases, rule skeleton, FP checklist — literacy file only, dest $MAL_LAB.
Visual · mal_yara_lab
Lab: write YARA pack. $MAL_LAB only. Original Cyberlium.
Opening
YARA pack before production handoff — anatomy and FP testing on paper first.
Lessons 5-1 through 5-3 covered YARA naming, rule anatomy, and false positives. This lab merges them into one YARA literacy pack for $MAL_LAB linked to M4 IOC strings. Optional: draft rule skeleton using placeholder strings from public report — no live sample required. No unauthorized scanning. Next: Quiz — YARA Literacy.
1. Lab contract: write the YARA pack
Create $HOME/cyberlium-lab/t22-m05-l04-yara-lab.txt merging use cases, rule skeleton, FP checklist, and link to M4 strings/hash pack.
Optional: yara rule.yar on static copy of legal training sample in $MAL_LAB — if infra available.
Command guide
Try these commands — Lab contract: write the YARA pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
YARA performance — https://yara.readthedocs.io/en/stable/writingrules.html ANY.RUN YARA hits — https://any.run/ (report YARA section literacy) VirusTotal YARA — https://www.virustotal.com/ (hunting literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install yara
Built-in (binutils)
macOS:
Command — copy this
brew install yara
Windows:
Command — copy this
choco install yara # or use WSL
Use WSL or install binutils
═══ LINUX / macOS ═══
Optional command
sudo apt install yara
Command — copy this
source "$HOME/cyberlium-lab/t22-mal/lab.env" 2>/dev/null || export LAB_MAL=$HOME/cyberlium-lab/t22-mal
strings "$HOME/cyberlium-lab/t22-mal/samples/eicar.com.txt" | grep -i eicar
yara "$HOME/cyberlium-lab/t22-mal/rules/eicar.yar" "$HOME/cyberlium-lab/t22-mal/samples/" 2>/dev/null || python3 -c "print('scan complete (python fallback) — apt install yara for CLI')"
ls -la "$HOME/cyberlium-lab/t22-mal/rules/"Primary tools to practice this lesson: yara, strings. Reference sites: YARA performance (https://yara.readthedocs.io/en/stable/writingrules.html); ANY.RUN YARA hits (https://any.run/); VirusTotal YARA (https://www.virustotal.com/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check offensive YARA misuse
Grep for FUD, evasion, unauthorized scan language — delete. Tutorials teaching AV bypass get rewritten to defender detection skeleton only.
Classmates write their own YARA packs for their $MAL_LAB.
3. Lock the proof
chmod 600 on the pack. Quiz next — then Dynamic Analysis Basics.
YARA literacy feeds dynamic sandbox module — static rules plus behavior.
4. What you ship: YARA literacy pack for $MAL_LAB
Use cases + rule skeleton + FP checklist merged. $MAL_LAB named. No evasion offense. chmod 600.
5. What you record before the next lesson
Date. YARA pack path. $MAL_LAB named. File t22-m05-l04-yara-lab.txt chmod 600.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Add AV evasion rule to pack. Scan production without authorization.
Right
Write YOUR YARA literacy pack for $MAL_LAB. chmod 600. Next: Quiz — YARA Literacy.
Mission: freeze YOUR YARA pack on disk
1) Merge M5 literacy sections. 2) Link M4 strings/hash pack. 3) chmod 600. Never include evasion or unauthorized scan steps.
Stuck? Ask Cyberlium AI Mentor
YARA packs bridge static IOCs and detection engineering.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: YARA pack should include FP test checklist.
True or False
Knowledge Check
APPLY: Rule skeleton meta should include:
Multiple choice