static-analysis-yara-analyze

YARA Rules Skill — Persistent Rule Lifecycle Management

Purpose: Store, retrieve, test, and optimize YARA rules across sessions using the PostgreSQL backend.

---

Database Schema

Table: yara_rules

SELECT column_name, data_type, is_nullable
FROM information_schema.columns
WHERE table_name = 'yara_rules'
ORDER BY ordinal_position;

Column	Type	Description
id	integer PK	Auto-increment
rule_id	varchar(100) UNIQUE	Stable ID, e.g. YARA-20260407-0001
name	varchar(255)	Rule name as in .yar file
description	text	Human-readable purpose
author	varchar(255)	Generating agent or operator
tags	jsonb	["rootkit", "ebpf", "persistence"]
rule_text	text	Full YARA source
rule_file_path	varchar(500)	Relative path on disk
status	varchar	draft / tested / active / false_positive / retired / optimized
source	varchar	ioc_derived / memory_pattern / binary_analysis / manual / threat_intel
severity	varchar	info / low / medium / high / critical
confidence	varchar	low / medium / high / confirmed
mitre_techniques	jsonb	["T1055", "T1014"]
mitre_tactics	jsonb	["defense_evasion", "persistence"]
ioc_source_ids	jsonb	IOCEntry.ioc_id values that generated this rule
generated_by_session_id	FK → forensic_sessions	Session that created the rule
project_id	FK → forensic_projects	Owning project
last_tested_at	timestamptz	When last tested
test_target	varchar(500)	Last scanned artifact/path
test_hits	integer	True-positive hits from last run
test_false_positives	integer	FPs from last run
test_notes	text	Tester notes
optimization_notes	text	Optimizer notes
performance_score	float	0.0–1.0 (higher = better)
created_at	timestamptz	Auto
updated_at	timestamptz	Auto

Table: yara_test_runs

Column	Type	Description
run_id	varchar(100) UNIQUE	e.g. RUN-20260407-001
rule_id	FK → yara_rules	The rule being tested
session_id	FK → forensic_sessions	Session running the test
target_path	varchar(500)	Scanned path
hits	integer	TP count
false_positives	integer	FP count
scan_duration_ms	integer	Scan time
raw_output	text	Raw yara CLI stdout
verdict	varchar(50)	pass / fail / fp_heavy / inconclusive
run_at	timestamptz	Auto

---

Standard Workflows

1 — Save a Generated Rule to DB

psql -U cybersec -d cybersec_forensics -c "
INSERT INTO yara_rules (
    rule_id, name, description, rule_text,
    status, source, severity, confidence,
    mitre_techniques, tags, author
) VALUES (
    'YARA-$(date +%Y%m%d)-$(shuf -i 1000-9999 -n1)',
    'Suspicious_LD_PRELOAD',
    'Detects LD_PRELOAD injection strings in ELF binaries and memory dumps',
    'rule Suspicious_LD_PRELOAD {
    meta:
        description = \"LD_PRELOAD injection indicator\"
        severity = \"high\"
    strings:
        \$s = \"LD_PRELOAD\" ascii wide nocase
        \$p = \"/etc/ld.so.preload\" ascii
    condition:
        any of them
}',
    'draft', 'memory_pattern', 'high', 'medium',
    '[\"T1574.006\"]', '[\"persistence\",\"privilege_escalation\"]',
    'memory-analyst'
) RETURNING rule_id, name, status;
"

2 — List Active Rules for Current Project

psql -U cybersec -d cybersec_forensics -c "
SELECT rule_id, name, severity, confidence, status, test_hits,
       array_to_string(tags::text[], ',') AS tags
FROM yara_rules
WHERE status IN ('active', 'tested', 'optimized')
ORDER BY severity DESC, confidence DESC;
"

3 — Test a Rule and Record Results

# Run YARA against a target
RULE_FILE="/tmp/cybersec-current.yar"
TARGET="/proc"                         # or a memory dump, binary, etc.

# Export rule from DB to file
psql -U cybersec -d cybersec_forensics -t -c \
    "SELECT rule_text FROM yara_rules WHERE rule_id = 'YARA-20260407-1234';" \
    > "$RULE_FILE"

# Run test (requires root for /proc)
HITS=$(yara -r "$RULE_FILE" "$TARGET" 2>/dev/null | wc -l)

# Record test run
psql -U cybersec -d cybersec_forensics -c "
INSERT INTO yara_test_runs (run_id, rule_id, target_path, hits, verdict, raw_output)
SELECT 'RUN-$(date +%Y%m%d%H%M%S)',
       id, '$TARGET', $HITS,
       CASE WHEN $HITS > 0 THEN 'pass' ELSE 'inconclusive' END,
       ''
FROM yara_rules WHERE rule_id = 'YARA-20260407-1234';

UPDATE yara_rules
SET last_tested_at = NOW(),
    test_hits = $HITS,
    test_target = '$TARGET',
    status = CASE WHEN $HITS > 0 THEN 'tested' ELSE status END
WHERE rule_id = 'YARA-20260407-1234';
"

4 — Promote Rule to ACTIVE

psql -U cybersec -d cybersec_forensics -c "
UPDATE yara_rules
SET status = 'active', confidence = 'high', updated_at = NOW()
WHERE rule_id = 'YARA-20260407-1234'
  AND test_hits > 0
  AND test_false_positives = 0;
"

5 — Export All Active Rules to a Single .yar Bundle

psql -U cybersec -d cybersec_forensics -t -c \
    "SELECT rule_text FROM yara_rules WHERE status = 'active' ORDER BY severity DESC;" \
    > ./cybersec-shared/yara-active-bundle.yar

echo "Exported $(grep -c '^rule ' ./cybersec-shared/yara-active-bundle.yar) active rules"

6 — Link Rule to IOC Source

# After generating from an IOCEntry
psql -U cybersec -d cybersec_forensics -c "
UPDATE yara_rules
SET ioc_source_ids = ioc_source_ids || '[\"IOC-2026-00123\"]'::jsonb
WHERE rule_id = 'YARA-20260407-1234';
"

---

Rule Lifecycle

IOC discovered / memory pattern found / binary analyzed
        │
        ▼
yara_rule_generator.py → INSERT INTO yara_rules (status='draft')
        │
        ▼
yara_rule_tester.py    → INSERT INTO yara_test_runs
                       → UPDATE yara_rules SET status='tested', test_hits=N
        │
        ▼
yara_rule_optimizer.py → UPDATE yara_rules SET
                             status='optimized',
                             performance_score=0.95,
                             optimization_notes='...'
        │
        ▼
Operator promotes      → UPDATE yara_rules SET status='active'
        │
        ▼
Session end sync       → Export active bundle → cybersec-shared/yara-active-bundle.yar

---

Integration with Agents

• @reverse-engineer → generates rules from binary signatures via yara_rule_generator.py
• @memory-analyst → generates rules from memory patterns and shellcode strings
• @hunter → promotes rules after cross-validation, queries active bundle before scan

When CYBERSEC-AGENT calls this skill, it should:

1. Load cybersec-shared/yara-active-bundle.yar at investigation start
2. After any binary/memory finding, trigger yara_rule_generator.py
3. Test new rules immediately with yara_rule_tester.py
4. Promote confirmed rules via the SQL above
5. At session end, re-export the active bundle

---

Quick Stats Query

psql -U cybersec -d cybersec_forensics -c "
SELECT status, COUNT(*) as rules,
       SUM(test_hits) as total_hits,
       ROUND(AVG(performance_score)::numeric, 2) as avg_perf
FROM yara_rules
GROUP BY status
ORDER BY status;
"