Troubleshooting Yara Rules

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Steps to troubleshoot when a Custom Yara Rule is not properly tagging files.

Environment

• App Control Console: Version 8.9.0+
• App Control Windows Agent: 8.8.0+

Resolution

1. Verify any Qualifiers are formatted correctly and applicable.
   • OnlyIf Macros are the only Qualifiers currently supported, example:

     Formatting: <OnlyIf:condition:value>
     Example: <OnlyIf:Hostname:*DSKTP-7*>

2. Verify the Yara Tags
   • Yara Rules should begin with the formatting: rule RuleName: tag example:

     rule TagsExample: tag1 tag2
     {
       ...
     }

   • Tags should be used in only one namespace. Do not use the same tag in the Classification namespace that is already in the IsInteresting namespace. 
   • Review the Detected Tags. If a Tag already exists, or is used by default it will show in the list of Detected Tags.
3. Verify case-sensitive information, examples:
   • ABC and abc can identify different Yara Rules.
   • Yara hashes use lower case hexadecimal digits, the following will never return true:

     hash.sha1(0, filesize) == "7193B6EDF651EAC1AB437F64B2FD6F203F8B702F"

4. Verify File Scanning was chosen correctly, example: if existing files need to be assigned tags, Rescan known files.
5. Verify Yara Keywords and other features are supported by the Yara Library version mentioned in the Agent's Release Notes.
   • Example: As of Windows Agent 8.9.6 the Yara Library was updated to version 4.05.
6. Verify the Yara Rule has been received by the Agent by using dascli.
   • Compare the Yara Rule version shown in dascli status matches the value from Assets > Computers. 
   • Use dascli find <file> to verify Yara results.
7. Verify any relevant Custom Rule has the appropriate Yara Tag(s) specified.

 

If issues persist, open a case with Support and provide:

• Full screenshot of any relevant Custom Yara Rule
• Full screenshot of any relevant Custom Rule using the related Yara Tags.
• CSV Export of any relevant Events from Reports > Events.
• Results of the dascli find <file> command, example:

  cd "C:\Program Files (x86)\Bit9\Parity Agent"
  dascli password GlobalPassword
  dascli find "C:\Test\YaraTestFile.exe"

• Agent Historical Logs from the machine being used for testing the Custom Yara Rule.

Additional Information

• Use extreme caution and thorough testing when using the Namespace IsInteresting 
  • Yara Rules can create significant performance issues especially when IsInteresting is used.
• In general, consider Yara Rules to be case-sensitive, examples:
  • ABC and abc can identify different Yara Rules.
  • Operators such as == and contains use case-sensitive semantics.