AutoYara4FLIRT is a very simple IDA plugin that automatically generates yara rules from files. The yara rules generated from ELF files can be used to create FLIRT signatures for the technique. For more information, see our blog post in More Details link.
- Move
AutoYara4FLIRT.pytoIDA's plugin folder- Ex) c:\Program files\IDA Pro 8.2\plugins\AutoYara4FLIRT.py
- Select
AutoYara4FLIRTon IDA- Ex) Edit -> Plugins -> AutoYara4FLIRT
CLI_AutoYara is a simple CLI tool that automates yara rule creation and the creation of sig files from hunted ELF binaries. In Addition, this tool can target multiple malware at once. It is also easy to use, requiring no external modules other than IDA related. Sample files are also available on this github for you to try out right away!
- Download
sigmake.exeinFlairfrom https://hex-rays.com/download-center/ - Download AutoYara4FLIRT
$ git clone https://github.com/JPCERTCC/AutoYara4FLIRT.git
$ cd AutoYara4FLIRT\CLI_AutoYara
- Edit
CLI_AutoYara.py
class ConfigVar:
"""
===================== Filepath ===========================
"""
SIGMAKE_DIR = "C:\\sigmake.exe" # <<<--- the path of `sigmake.exe` !!!
IDA_INSTAll_PATH = "C:\\\"Program Files\"\\\"IDA Pro 8.2\""
IDA_SIG_PATH = r"C:\Program Files\IDA Pro 8.2\sig"
"""
==========================================================
"""Targeted ELF->.yara
$ python CLI_AutoYara.py --autoyara [BITS-of-Arch-in-ELFfile]
# Example
$ python CLI_AutoYara.py --autoyara 32
Hunted ELF->.sig
$ python CLI_AutoYara.py --elf2sig [BITS-of-Arch-in-ELFfile] [Sig-Name] [Sig-Directory]
# Example
$ python CLI_AutoYara.py --elf2sig 32 SigName pc
- English https://blogs.jpcert.or.jp/en/2023/06/autoyara4flirt.html
- Japanese https://blogs.jpcert.or.jp/ja/2023/06/autoyara4flirt.html
- F.L.I.R.T https://hex-rays.com/products/ida/tech/flirt/
- Generating FLAIR function patterns using IDAPython https://www.mandiant.com/resources/blog/flare-ida-pro-script
- idb2pat https://github.com/mandiant/flare-ida
Please read the LICENSE page.