I have to write a Yara rules for malwares that is based on assember code. Suppose I have an unpacked malware sample. To avoid false positives, the selected code must be unique. Can anyone tell me which code is suitable and which is not? For example mov eax,1 would not be a good choice. But what code would be a good criterion? What are the criterions for Yara rules based assembler codes?
Agree with Robert - The common way to avoid false positives is having a large software pool of known benign software you can check your rules with.
If you are just starting to write yara rules then concentrate on the easy way that is strings, write yara rules based on the unique strings.
To answer this: Can anyone tell me which code is suitable and which is not? What are the criterions for Yara rules based assembler codes?
Some of the criteria which you can use:
- Any single line assembly code will be bad choice, you will need few lines of assembly code
- Write yara rule based on custom encryption/decryption loop with unique key
- Don't take standard encryption/decryption like RC4 for yara rule, that's why I said custom in above point
- Don't include yara rule with too many address offset as it may not hit another hash
- Wild card address offset to hit different hashes of the same malware family
- Take a code pattern which is performing some unique steps which is specific to this malware sample
- Mixture of few strings and assembly code should give you good result
This above list is not a comprehensive criteria but you will learn more by doing it and looking through existing Yara rules.
Check this repository for different type of Yara Rules, you will get some idea for strings and assembly code Yara rules: https://github.com/Yara-Rules/rules