YARA & Sigma for SOC Analysts Skill Assessment

Today we are going to solve the Skill Assessment of YARA & Sigma for SOC Analysts module on HTB.

Lets get started !

Q1: The "C:\Rules\yara\seatbelt.yar" YARA rule aims to detect instances of the "Seatbelt.exe" .NET assembly on disk. Analyze both "C:\Rules\yara\seatbelt.yar" and "C:\Samples\YARASigma\Seatbelt.exe" and specify the appropriate string inside the "$class2" variable so that the rule successfully identifies "C:\Samples\YARASigma\Seatbelt.exe". Answer format: L________r

Solving Step By Step: The question is clearly stating that there is a rule living inside the Directory C:\Rules\yara, Rule file name is seatbelt.yar which is been used to detect Seatbelt.exe. We need to analyse both rules file and the malware Seatbelt to write an appropriate artifact inside the variable $classs2 so that the rule can work properly and detect the malware seatbelt.exe precisely.

What Seatbelt.exe malware is ?

In smple term it is a C# security tool which is used for safety checks for offensive and defensive security purposes, it is commonly used by attackers for credentials theft and gathering information.

Lets start the analysis first by going in to the Rule file to get a quick glance on the rules,

We can see as mentioned in the question the variable $class2 is empty and we need to fill it with an appropriate string so that t can detect the Seatbelt.exe To find the missing piece we need to run the command strings in the PowerShell so that we can get all the strings that are present inside the malware without any issues.

Command:

strings Seatbelt.exe | Select-String "^L.*r$"

Select-String "^L.*r$" Will get us only the strings that Starts with L and ends with r. It helps use to reduce the noise of the strings that we donot need.

Answer: LsaWrapper

You may ask, Whats LsaWrapper ? LsaWrapper is used for managing users rights and privileges

Q2: Use Chainsaw with the "C:\Tools\chainsaw\sigma\rules\windows\powershell\powershell_script\posh_ps_susp_win32_shadowcopy.yml" Sigma rule to hunt for shadow volume deletion inside "C:\Events\YARASigma\lab_events_6.evtx". Enter the identified ScriptBlock ID as your answer.

This is a very simple question we just need to know the command that will help us and we will get the answer,

Command:

.\chainsaw_x86_64-pc-windows-msvc.exe hunt lab_events_6.evtx -s posh_ps_susp_win32_shadowcopy.yml — mapping .\mappings/sigma-event-logs-all-new.yml

Answer: faaeba08–01f0–4a32-ba48-bd65b24afd28

Note : In the above 2 commands my file paths are different so please replace those file paths according to your lab machine paths.

Congrats you have conquered YARA & Sigma for SOC Analysts module 🎉🎉 Follow me for more insights and write-ups

My Socials : https://www.linkedin.com/in/abdul-rahman-a97239329/

Peace out. see you soon.