sec51 / clamav-yara Goto Github PK

View Code? Open in Web Editor NEW

52.0 7.0 15.0 101.82 MB

Converts the Clamav Virus Database definitions to YARA rules [GOLANG]

License: ISC License

Go 81.55% Smarty 18.45%

clamav-yara's Introduction

Convert ClamAV definitions to Yara rules

===

Clamav To Yara features:

Downloads the definitions periodically from clamav: at the moment hard coded in main.go to 4 hours
Checks the definitions were changes via Etag
ON HOLD: Checks the hash of the definitions files is valid. Got around it by installing clamav on our servers with freshclam and setting the URLs to our servers, which downloads in HTTPS
Extract the signatures and generate YARA rules. At the moment the ClamAV file parsed are: NDB, HDB, HSB. MDB and MSB are done as well, but need to find a way to generate proper YARA rules with that.

===

How to generate the rules

git clone https://github.com/sec51/clamav-yara.git

go build

go test -v

./clamav-yara

You can then find the generated Yara rules inside the rules folder

===

TODO

Use FILE module on OSX and LINUX to detect the file type and scan that specific file only.
Test if FILE, PE, ELF module cause memory leaks
Wait for Golang 1.6 and hope that they introduce the {{- end}} tag in the template package, to remove the empty spaces.

===

LICENSE

Permission to use, copy, modify, and distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.

THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

clamav-yara's People

Contributors

Stargazers

Watchers

Forkers

pombredanne hainguyen007 chennqqi ralex1975 jrelo flyr4nk 5up3rc imuledx dmknght anomalroil derekhjray hecg119 webvul go-community int2ecall

clamav-yara's Issues

Certificate outdated

https://sec51.com/definitions/main.cvd certificate expired on January 2017, thus clamav-yara can't proceed

error: regular expression is too complex

Hello.
After parsing I have rules.
But I can't use them:

yara main_linux.yara /bin/ls
yara main_windows.yara prog.exe

I have error described below:

main_windows.yara(464362): warning: $signature in rule Win_Trojan_Lineage_85 is slowing down scanning
main_windows.yara(468844): warning: $signature in rule Win_Exploit_CVE_2006_4182_1 is slowing down scanning
main_windows.yara(804367): error: regular expression is too complex
main_windows.yara(804385): error: regular expression is too complex
main_windows.yara(821872): warning: $signature in rule Win_Trojan_SwizzorA_1 is slowing down scanning
main_windows.yara(821881): warning: $signature in rule Win_Trojan_Swizzor_607 is slowing down scanning
main_windows.yara(870184): warning: $signature in rule Win_Adware_Multiplug_3 is slowing down scanning
main_windows.yara(881315): error: invalid field name "virtual_address"

Duplicate rules names

The rule names are generated from ClamAV malware name.
In ClamAV definitions the same name appears multiple times.
We need to add an additional identifier to the Malware name.
This is visible when generating the rules from the main.cvd

Parsing error - slice bounds out of range

2018/02/19 12:00:16 Downloading main definitions from https://sec51.com/definitions/main.cvd ...
2018/02/19 12:00:16 Download completed, proceeding with parsing.
2018/02/19 12:01:02 main.cvd parsing completed.
=========================
2018/02/19 12:01:02 Downloading daily definitions from https://sec51.com/definitions/daily.cvd ...
2018/02/19 12:01:02 Download completed, proceeding with parsing.
panic: runtime error: slice bounds out of range

goroutine 1 [running]:
main.extractFiles(0xc4201b2400, 0xb2, 0x200, 0x1, 0x0, 0x0, 0x0)
	/home/corey/git/clamav-yara/definitions.go:296 +0xb61
main.(*DefinitionsManager).DownloadDefinitions(0xc42005c480, 0xc42000e001, 0x0, 0x0)
	/home/corey/git/clamav-yara/definitions.go:237 +0x48b
main.downloadDefinitions(0xc42005c480)
	/home/corey/git/clamav-yara/main.go:34 +0x98
main.main()
	/home/corey/git/clamav-yara/main.go:19 +0x8e

Parse additional signatures

At the moment we are parsing only NDB signatures.
Add:

HDB signatures
HSB signatures

Both signatures are for file only. Basically they can detect static malware only.
The format is the following:

HashString:FileSize:MalwareName

The difference between the two is that HDB uses md5 whereas HSB uses sha1 and sha256 we need to distinguish based on the length of the hash.

In YARA we need to use the hash plugin and do something like this:

condition:
        hash.md5(0, filesize) == "md5_hash_obtained_from_clamav_signatures"

sec51 / clamav-yara Goto Github PK

clamav-yara's Introduction

Convert ClamAV definitions to Yara rules

Clamav To Yara features:

How to generate the rules

TODO

LICENSE

clamav-yara's People

Contributors

Stargazers

Watchers

Forkers

clamav-yara's Issues

Certificate outdated

error: regular expression is too complex

Duplicate rules names

Parsing error - slice bounds out of range

Parse additional signatures

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent