Lab Instructions

For this exercise, you are provided a rule for malware detection that accidentally matches on the legitimate Microsoft Malware Removal Tool (mrt.exe). MRT.exe is a legitimate security product and the rule is not meant to match on it, so you can think of it as a False Positive (FP) that needs to be fixed. In this lab, you should edit the rule to fix the issue so that it no longer matches on the provided file, and add other logic that will improve the rule.


rule TTP_xor_shellcode {
strings:
	$s = "shellcode" xor(0x01-0xff)
condition:
	$s
}

Sha256 of sample: 9f4c45b5045bde733167ac555906caf9c063c5f2140aa501a3f9838a81265e33
(Legitimate mrt.exe)


Zip of sample: goodware-mrt-exe-9f4c45.zip


Zip password: not password protected


Attempt this lab on your own first, and then review my walkthrough video below to see how I approached it.



Full Rule Solutions

import "pe"
rule TTP_xor_shellcode_hifi {
strings:
	$s = "shellcode" xor(0x01-0xff)
condition:
	uint16be(0) == 0x4d5a // anchor to PE MZ header
    and filesize < 10MB 
    and pe.number_of_signatures == 0
    and pe.pdb_path != "mrt.pdb" //pdb_path = "mrt.pdb"
    and $s
    and #s < 20
}
rule TTP_xor_shellcode_lowfi {
strings:
	$s = "shellcode" xor(0x01-0xff)
condition:
	uint16be(0) == 0x4d5a // anchor to PE MZ header
    and filesize < 10MB 
    and pe.pdb_path != "mrt.pdb" //pdb_path = "mrt.pdb"
    and $s
}
