YARA

# ── INSTALACIÓN ───────────────────────────────────────
# Ubuntu/Debian
sudo apt install yara

# macOS
brew install yara

# Verificar
yara --version

# ── ESTRUCTURA DE UNA REGLA ────────────────────────────
# Regla básica con string de texto
cat > detect_c2.yar << 'EOF'
rule Detect_C2_Server {
    meta:
        description = "Detecta un servidor C2 conocido"
        author = "CyberFlows"
        date = "2026-07-23"
        severity = "high"
        reference = "https://example.com/report"

    strings:
        $c2_url = "http://evil-server.com/beacon" ascii wide
        $c2_path = "/gate.php" ascii
        $mutex = "Global\Mutex_Malware_v3" ascii
        $hex_pattern = { 8B 45 ?? 03 C1 89 45 ?? 8B 4D }

    condition:
        2 of them
}
EOF

# ── ESCANEAR ARCHIVOS ──────────────────────────────────
# Escanear un archivo específico
yara detect_c2.yar suspicious_file.exe

# Escanear un directorio completo
yara detect_c2.yar -r /path/to/samples/

# Escanear con recurrencia
yara -r rules/ /evidence/ > scan_results.txt

# ── REGLAS AVANZADAS ───────────────────────────────────
# Regla con patrones hex y operadores lógicos
cat > detect_ransomware.yar << 'EOF'
rule Detect_Ransomware_Behavior {
    meta:
        description = "Detecta comportamiento típico de ransomware"
        severity = "critical"

    strings:
        $readme1 = "YOUR FILES ARE ENCRYPTED" ascii wide nocase
        $readme2 = "DECRYPT" ascii wide nocase
        $readme3 = "how to decrypt" ascii wide nocase
        $ext = ".locked" ascii
        $ext2 = ".encrypted" ascii
        $bitcoin = "bitcoin" ascii wide nocase
        $onion = ".onion" ascii wide nocase
        $vssadmin = "vssadmin delete shadows" ascii wide nocase
        $bcdedit = "bcdedit /set {default} recoveryenabled no" ascii wide nocase
        $cipher = "cipher /W:" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D and
        3 of them
}
EOF

# ── USO EN RESPONSE A INCIDENTES ───────────────────────
# Buscar indicadores en memoria dump
yara -r iocs_rules/ memory_dump.raw

# Escanear todos los procesos en Linux
yara -r rules/ /proc/*/exe 2>/dev/null

# ── REGLA MODULAR ──────────────────────────────────────
# base_strings.yar — strings comunes de malware
cat > base_strings.yar << 'EOF'
private rule Is_PE {
    condition:
        uint16(0) == 0x5A4D
}

private rule Has_Persistence {
    strings:
        $reg1 = "CurrentVersion\\Run" ascii
        $reg2 = "CurrentVersion\\RunOnce" ascii
        $task = "schtasks" ascii wide
    condition:
        any of them
}

private rule Has_Network {
    strings:
        $http = "http://" ascii
        $https = "https://" ascii
        $tor = ".onion" ascii
        $c2_useragent = "User-Agent:" ascii
    condition:
        2 of them
}
EOF

# regla_completa.yar — reutiliza las reglas base
cat > regla_completa.yar << 'EOF'
import "pe"
import "math"

rule Malware_Generic {
    meta:
        description = "Detección genérica de malware"
        author = "CyberFlows"
        severity = "high"

    strings:
        $s1 = "CreateRemoteThread" ascii
        $s2 = "VirtualAllocEx" ascii
        $s3 = "WriteProcessMemory" ascii
        $s4 = "NtUnmapViewOfSection" ascii
        $s5 = "IsDebuggerPresent" ascii

    condition:
        Is_PE and
        filesize < 5MB and
        3 of ($s*) and
        not Has_Persistence
}
EOF

# ── TESTING DE REGLAS ──────────────────────────────────
# Escanear colección de malware conocido (debe detectar)
yara regla_completa.yar -r malware_samples/

# Escanear sistema operativo limpio (no debe detectar)
yara regla_completa.yar -r /usr/bin/ /usr/lib/ 2>/dev/null

# Contar falsos positivos
yara regla_completa.yar -r /evidence/ 2>/dev/null | wc -l

# ── REGLA CON PESOS Y CONTADORES ───────────────────────
cat > regla_pesos.yar << 'EOF'
rule Malware_Ponderado {
    strings:
        $api1 = "InternetOpenA" ascii weight 2
        $api2 = "HttpSendRequestA" ascii weight 2
        $api3 = "URLDownloadToFileA" ascii weight 3
        $enc1 = "CryptEncrypt" ascii weight 1
        $enc2 = "CryptGenKey" ascii weight 1
        $perf = "NtQueryInformationProcess" ascii weight 2
        $debug = "CheckRemoteDebuggerPresent" ascii weight 3

    condition:
        uint16(0) == 0x5A4D and
        filesize < 10MB and
        $api3 and
        (
            ($api1 and $api2) or
            ($enc1 and $enc2) or
            $debug
        )
}
EOF

# ── SCRIPT DE ESCANEO AUTOMATIZADO ─────────────────────
cat > yara_scanner.sh << 'SCRIPT'
#!/bin/bash
# Escáner YARA automatizado para directorios

RULES_DIR="$1"
TARGET_DIR="$2"
REPORT_DIR="./yara_reports/$(date +%Y%m%d_%H%M%S)"
mkdir -p "$REPORT_DIR"

echo "=== ESCANEO YARA AUTOMATIZADO ==="
echo "Reglas: $RULES_DIR"
echo "Objetivo: $TARGET_DIR"
echo "Fecha: $(date)"
echo ""

# Escanear y generar reporte
find "$TARGET_DIR" -type f | while read file; do
    yara -r "$RULES_DIR" "$file" 2>/dev/null
done > "$REPORT_DIR/all_matches.txt"

# Resumen por regla
echo "--- COINCIDENCIAS POR REGLA ---" > "$REPORT_DIR/summary.txt"
cut -f1 "$REPORT_DIR/all_matches.txt" | sort | uniq -c | sort -rn >> "$REPORT_DIR/summary.txt"

# Estadísticas
echo "" >> "$REPORT_DIR/summary.txt"
echo "Total archivos escaneados: $(find $TARGET_DIR -type f | wc -l)" >> "$REPORT_DIR/summary.txt"
echo "Total coincidencias: $(wc -l < $REPORT_DIR/all_matches.txt)" >> "$REPORT_DIR/summary.txt"
echo "Reglas activas: $(ls $RULES_DIR/*.yar 2>/dev/null | wc -l)" >> "$REPORT_DIR/summary.txt"

cat "$REPORT_DIR/summary.txt"
SCRIPT
chmod +x yara_scanner.sh

# ── INTEGRACIÓN CON CRON ───────────────────────────────
# Escanear cada hora un directorio compartido
echo "0 * * * * /opt/scripts/yara_scanner.sh /rules/ /shared/uploads/ >> /var/log/yara_scan.log 2>&1" | sudo tee /etc/cron.d/yara-scan

# ── INTEGRACIÓN CON VOLATILITY ─────────────────────────
# Crear regla desde hallazgo de Volatility
cat > vol_artifact.yar << 'EOF'
rule Detect_Suspicious_Injection {
    meta:
        description = "Detecta código inyectado encontrado con Volatility"
        source = "memory_forensics"

    strings:
        $mz = { 4D 5A }
        $api1 = "VirtualAlloc" ascii
        $api2 = "VirtualProtect" ascii
        $shellcode = { 60 89 E5 31 C0 64 8B 50 30 8B 52 0C 8B 52 14 }

    condition:
        $mz at 0 and filesize < 1MB and
        ($api1 or $api2) and
        $shellcode
}
EOF

# Escanear dumps de memoria extraídos con Volatility
yara vol_artifact.yar ./evidence/*.bin