Malware detection with ClamAV and YARA
You scan servers and file shares with ClamAV, write your own detection rules with YARA and set up regular scanning while weeding out false positives.
Level 201 · 15 lessons · 15 practice labs
Lessons
ClamAV
- Installing ClamAV and updating signatures: freshclam
- Scanning with clamscan and clamdscan
- On-access scanning and quarantine
- Writing your own ClamAV signatures: hash and body signatures
- Short task: quarantine the suspicious files in a shared folder
YARA
- Structure of a YARA rule: meta, strings, condition
- Text, hex and regular expression strings
- Conditions: counts, offsets and file size
- More precise rules with the pe and hash modules
- Testing a rule against clean files
- Short task: write one rule that catches a whole sample family
Operations
- Scheduled scans and the report email
- Scanning files at upload time on the web
- Sweeping systems with hashes from threat intelligence
- Capstone: scan a file server, triage the findings and report
Practice labs
- Scan the share and quarantine what you find: Scan the folder with fresh signatures, move the findings to a quarantine folder and save the report.
- Catch the file missed because signatures were stale: Compare a scan with the old database to one with the current database and show the file that explains the difference.
- Make the scan catch a sample hidden inside an archive: Find why a file inside nested archives was skipped, adjust the scan limits and get the sample caught.
- Write a hash signature for a sample: Build an .hdb signature from the sample’s hash, use it with clamscan and show only that file is caught.
- Write a body signature that covers the family: Find a byte sequence common to three samples, write an .ndb signature and show no false alarms on clean files.
- Write a first YARA rule that uses a string: Use a unique text in the sample to write a rule and show it matches only the sample.
- Find the sample this YARA rule misses and fix the rule: Find why the rule misses the family’s fourth sample, widen the condition and show no matches on clean files.
- Cover changing bytes with a hex string and wildcards: Write the bytes that change between versions as a hex string with wildcards and catch every version.
- Bring false alarms to zero with the pe module: Narrow a rule that also fires on clean software with import and section conditions and prove it on the test set.
- Write a fast rule using file size and offsets: Speed up a rule that runs slowly on a large file store with size and offset conditions and compare the timing.
- Sweep the server with hashes from threat intel: Use the given hash list to sweep the file system and report the path of the matching file.
- Scan web uploads before they are stored: Set up on-the-fly scanning with clamd for the upload folder and show a malicious test file is rejected.
- Find that the scheduled scan has been failing silently: Find why the cron job sends empty reports, fix it and show the finding in the email from the next run.
- Narrow a signature that also catches a harmless file: Show that your own signature wrongly flags an in-house tool, narrow it with a logical condition and test it against both the sample set and the clean set.
- Find the expensive string in a slow YARA rule: Time the rule on a large folder, identify the string that is too short and too common, and note which one slows the scan down.
About this course
You scan servers and file shares with ClamAV, write your own detection rules with YARA and set up regular scanning while weeding out false positives.
What you will learn
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.