Skip to content

Further Analysis of raw Yara output #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
aungthurhahein wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Further Analysis of raw Yara output #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ee63fd8
reporting and style updated
aungthurhahein Oct 19, 2015
0e3930f
output and futher analysis
aungthurhahein Dec 3, 2015
1ff4b51
readme and analysis bash file added
aungthurhahein Dec 3, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 26 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,5 +127,31 @@ root@system:~/Desktop/page/page_brute/PAGE_BRUTE-2013-10-27-01:20:28-RESULTS/web
00000e0: 2020 3c74 6420 7374 796c 653d 2270 6164 <td style="pad
00000f0: 6469 6e67 2d62 6f74 746f 6d3a 202e 3165 ding-bottom: .1e

```

### Addtional output files
2 addtional output files are written to analyze matched page blocks and page IDs.

1. intputfilename_pagelist: it contains all the list of pages bock IDs that match with Yara rule sets.
2. intputfilename_pageblocks: it contains all page blocks that match with Yara rule sets.

### Further Analysis

As for the scenario of scanning a pagefile with 3 different yara rule sets, it is possible to extract the page IDs that matches with multiple Yara rules. The purpose is to narrow down false positives and the investigators can focus on page blocks that contains information.

For e.g, By looking at the output, it can be seen that page block 114126 contains http header with URL address.

```
pageblock Yara Rules
114126 http_request_header;http_response_header;url_address
```

A bash script, **further_analysis.sh**, is implemented to achieve it as the following processing;

1. From muliple intputfilename_pagelist output, all page IDs with its corresponding Yara rules are combined.
2. Unique page IDs and repeated Page IDs are written to allpage.uniq and allpage.repeats respectively.
3. python script,rules_IDrepeats_map.py, will map page IDs with its corresponding rules in the following format:

```
page block ID rule-1;rule-2...rule-n
```
Loading