Basic String to Rule Script

This Python script illustrates taking a string input and injecting it into a YARA rule template of your choice. This takes advantage of Python text transformations and YARA modifiers to create rule-friendly string variations.


#!/usr/bin/env python3

import argparse
import sys
import re

def parseArguments():

    parser = argparse.ArgumentParser(description="Arguments for script")
    parser.add_argument('--string', default=None, type=str, help="input string")
    args = parser.parse_args()
    return args

def main():

    args = parseArguments()
    if args.string:
        try:
            clean_str = re.sub('\W+','',args.string.strip())
            in_string = args.string
            print("\n")
            print("rule mal_string_variations_"+clean_str+" {")
            print("\tstrings:")
            print("\t\t$plain = \""+in_string+"\" nocase ascii wide")
            print("\t\t$b64_input = \""+in_string+"\" base64 base64wide")
            print("\t\t$b64_upper = \""+in_string.upper()+"\" base64 base64wide")
            print("\t\t$b64_lower = \""+in_string.lower()+"\" base64 base64wide")
            print("\t\t$xor_input = \""+in_string+"\" xor(0x01-0xff)")
            print("\t\t$xor_upper = \""+in_string.upper()+"\" xor(0x01-0xff)")
            print("\t\t$xor_lower = \""+in_string.lower()+"\" xor(0x01-0xff)")
            print("\tcondition:")
            print("\t\tany of them")
            print("}")
            print("\n")
        except:
            print("Error in rule printout.")

if __name__ == '__main__':
    main()




