Use Yara custom rules with Osquery-Manager

Elastic Stack Beats
, ,
1

Hello Team,

Is It possible to use yara custom rules with osquery manager integration ??
I'm using version 7.17.1

Many thanks.

2

Hey, yes. This is totally possible.

3

Sorry, meant to reply with some additional detail. Here's an example:

SELECT * FROM yara WHERE path LIKE '/var/www/html/images/%' AND count > 0 AND sigrule IN ( 'rule Mozi { strings: $a = { 55 50 58 21 [4] 00 00 00 00 00 00 00 00 00 00 00 00 } condition: all of them and $a in (0 .. 255) }');

Screenshot 2022-04-20 at 13.49.53
Screenshot 2022-04-20 at 13.49.533192×2246 399 KB

If you want to include the strings in the tabular output, you'll need to add the following to the osquery manager integration config:

{
  "options": {
    "enable_yara_string": true
  },
  "packs": {}
}

Screenshot 2022-04-20 at 13.50.25
Screenshot 2022-04-20 at 13.50.252484×972 125 KB

2 Likes
4

Thank you very much, I'm going to try it.

5

thank you very much.
It's working great but noticed that path LIKE 'dir1/%' is not recursive, can I do anything about this ?

1 Like
6

You would need something like path LIKE 'dir1/%/%' I believe.

7

Thank you very much.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.