yara_forge/patterns/
mod.rs

1//! Common YARA pattern libraries
2//! Provides pre-defined patterns for various detection scenarios
3
4/// File header patterns for common file types
5pub const FILE_HEADERS: &[&str] = &[
6    "4D 5A",       // MZ (Windows executable)
7    "7F 45 4C 46", // ELF (Linux executable)
8    "50 4B 03 04", // ZIP archive
9    "FF D8 FF",    // JPEG
10    "89 50 4E 47", // PNG
11];
12
13/// Common encryption API patterns
14pub const ENCRYPTION_APIS: &[&str] = &[
15    "CryptoAPI",
16    "OpenSSL",
17    "BCrypt",
18    "AES_encrypt",
19    "RC4_encrypt",
20];
21
22/// Common ransomware file extensions
23pub const RANSOMWARE_EXTENSIONS: &[&str] =
24    &[".encrypted", ".locked", ".crypted", ".crypt", ".WNCRY"];
25
26/// Command and control (C2) patterns
27pub const C2_PATTERNS: &[&str] = &[
28    "cmd.exe",
29    "powershell.exe",
30    "nc.exe",
31    "netcat",
32    "reverse_tcp",
33];
34
35/// Code obfuscation patterns
36pub const OBFUSCATION_PATTERNS: &[&str] = &[
37    "eval(",
38    "base64_decode(",
39    "chr(",
40    "fromCharCode",
41    "unescape(",
42];
43
44/// Common process injection patterns
45pub const PROCESS_INJECTION: &[&str] = &[
46    "VirtualAllocEx",
47    "WriteProcessMemory",
48    "CreateRemoteThread",
49    "NtCreateThreadEx",
50    "RtlCreateUserThread",
51];
52
53/// Common registry persistence keys
54pub const PERSISTENCE_REGISTRY_KEYS: &[&str] = &[
55    "Software\\Microsoft\\Windows\\CurrentVersion\\Run",
56    "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce",
57    "Software\\Microsoft\\Windows\\CurrentVersion\\RunServices",
58    "Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce",
59];
60
61/// Common sandbox evasion techniques
62pub const SANDBOX_EVASION: &[&str] = &[
63    "GetTickCount",
64    "QueryPerformanceCounter",
65    "GetSystemTime",
66    "GetComputerNameA",
67    "GetProcessHeap",
68];
69
70/// Generate hex pattern with wildcards
71pub fn generate_hex_pattern(pattern: &[u8], mask: &[bool]) -> String {
72    assert_eq!(
73        pattern.len(),
74        mask.len(),
75        "Pattern and mask must have the same length"
76    );
77
78    pattern
79        .iter()
80        .zip(mask.iter())
81        .map(|(byte, &is_fixed)| {
82            if is_fixed {
83                format!("{:02X}", byte)
84            } else {
85                "??".to_string()
86            }
87        })
88        .collect::<Vec<_>>()
89        .join(" ")
90}
91
92/// Generate base64 pattern
93pub fn generate_base64_pattern(data: &[u8]) -> String {
94    use base64::{engine::general_purpose::STANDARD, Engine as _};
95    STANDARD.encode(data)
96}
97
98/// Generate SHA256 pattern
99pub fn generate_sha256_pattern(data: &[u8]) -> String {
100    use sha2::{Digest, Sha256};
101    let mut hasher = Sha256::new();
102    hasher.update(data);
103    let result = hasher.finalize();
104    format!("{:x}", result)
105}
106
107#[cfg(test)]
108mod tests {
109    use super::*;
110
111    #[test]
112    fn test_hex_pattern() {
113        let pattern = &[0x48, 0x45, 0x4C, 0x4C, 0x4F];
114        let mask = &[true, true, false, true, true];
115        let result = generate_hex_pattern(pattern, mask);
116        assert_eq!(result, "48 45 ?? 4C 4F");
117    }
118
119    #[test]
120    fn test_base64_pattern() {
121        let data = b"Hello World!";
122        let result = generate_base64_pattern(data);
123        assert_eq!(result, "SGVsbG8gV29ybGQh");
124    }
125
126    #[test]
127    fn test_sha256_pattern() {
128        let data = b"test data";
129        let result = generate_sha256_pattern(data);
130        assert_eq!(
131            result,
132            "916f0027a575074ce72a331777c3478d6513f786a591bd892da1a577bf2335f9"
133        );
134    }
135}
yara_forge/patterns/mod.rs

yara_forge/patterns/
mod.rs
