Note: this blog series now exists in a cleaned-up full whitepaper form at https://hubs.ly/H0pvD_30
Note: this blog series now exists in a cleaned-up full whitepaper form at https://hubs.ly/H0pvD_30
We call our approach YARA-L because it is inspired by YARA — invented by Google VirusTotal for malware analysis and applied to logs (hence the “L”) and other security telemetry inside the Chronicle platform.
What is important is that YARA-L is a language to express detections, not merely to query the data in order to eventually use said data for detection. In essence, it is a threat detection language, not a data query language! It is designed by and for security analysts, admittedly with some help from malware reverse engineers (who created the original YARA).
Building to become “the standard” or even “a standard” for expressing detection is a monumental undertaking. Understanding the success of YARA is essential in developing a strategy for nurturing the success of our detection language, YARA-L, broadly and Chronicle rule engine specifically.
How will YARA-L be used with Chronicle [not all of the below are real today, to be sure]?
- Define real-time detection rules
- Define historical detection rules of arbitrary complexity
- Perform advanced (hunting-style) searches
Admittedly, the cases 2 and 3 are similar, but 2. implies a scheduled rule run leading to an alert while 3 is about interactive exploration of data by a human analyst.
YARA — L Scenarios
What are some of the scenarios where we think this approach really shines?
- You hear about a new malware that uses a particular registry key for persistence
- You analyze a new threat and realize that it uses a Powershell launching with a hidden window parameter
- You have a need to expand coverage of a particular MITRE ATT&CK technique in your environment
- You want to cast a wide net of looking for types of newly popular suspicious activities such as access to browser cookie and credential files
- You need to watch for specific activities that are necessary for the attacker to take in order to steal particularly valuable data
YARA-L shines in all those scenarios and while other approaches may help with some of them, it is hard to find an approach that works universally.
One, a traditional SIEM product with a UI-based rule configuration lacks flexibility and hence the coverage of use cases, coupled with typically slower performance. Two, a search-based tool will require a layer of additional data analysis to deliver the detections. Three, a programming language-based approach (say express detection rules in Python or Go as some elite organizations do) would be a massive overkill for non-programming SOC analysis and other security professionals. We feel that YARA-L is the “just right” approach for the threat detection problem today.
Detection needs continue to shift and grow as organizations realize legacy product solutions are not the sole answer to security. As investments are made into human analysts, threat responders and hunters, we have the opportunity to introduce YARA-L as both a microscope and wide angle lens to defenders’ toolkits. We must support an investigative mindset that allows for ready on-boarding and application of threat intelligence, analyst insights, and investigative techniques.
Thus far, the collective industry has failed to develop a unified solution and remains unable — in most cases and/or without extreme reliance on uniquely talented people — to effectively use procedural based detectors derived from the study of attacker TTPs. YARA-L is an opportunity to throw our hat into the ring while also providing Chronicle customers a powerful mechanism to detect threats and intuitively pursue and iterate upon security investigations.
YARA-L Example
Example MITRE ATT&CK Technique T1054 Blocking of Indicators
profile mitre_T1054_Possible_Indicator_Blocking
{
meta:
author = “Chronicle”
description = “Detection for registry change used to bypass Event Tracing for Windows (ETW)”
reference = “https://attack.mitre.org/techniques/T1054/"
version = “1.0”
created = “2019–12–13”
function:
func RegChange()
if ( (udm.metadata.event_type == “REGISTRY_MODIFICATION” or udm.metadata.event_type == “REGISTRY_CREATION” ) and
re.regex(udm.target.Registry.registry_key, “HKLM\SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\AUTOLOGGER_NAME.*”) )
then
return true
end
return false
end
condition:
if ( RegChange() ) then
outcome.match()
end
}
P.S. I can be convinced to drop more examples, if you are curious.
(written together with Brandon Levene)
Originally published at Medium.
