Signature Based Detection #10

New Issue

2025-10-08T04:49:58Z

serrindipity commented

2025-10-08 04:49:58 +00:00

Use the sig-detection branch

Use the `sig-detection` branch

nini.b-612 self-assigned this 2025-10-08 04:55:47 +00:00

kuljit added reference sig-detection

2025-10-08 22:24:33 +00:00

nini.b-612 commented

2025-10-15 00:23:32 +00:00

If we use Grafana Loki and Promtail as our logging aggregation tools, there is the benefit of both YARA and ClamAV scanners (which it was requested that I look into) having the ability to be connected and log to stdout or a local file.

Example Command: echo "[ALERT] $(date): $(basename "$file") matched rule: $rule_name" >> /var/log/scanner.log

Promtail then sends /var/log/scanner.log to Loki.
This would be how we centralize both script output and server logs into one human-readable place.

Note that this benefit is also noted in the logging aggregation issue since it applies to both.

If we use Grafana Loki and Promtail as our logging aggregation tools, there is the benefit of both YARA and ClamAV scanners (which it was requested that I look into) having the ability to be connected and log to stdout or a local file. Example Command: `echo "[ALERT] $(date): $(basename "$file") matched rule: $rule_name" >> /var/log/scanner.log` - Promtail then sends `/var/log/scanner.log` to Loki. - **This would be how we centralize both script output and server logs into one human-readable place.** Note that this benefit is also noted in the logging aggregation issue since it applies to both.

nini.b-612 commented

2025-10-15 00:27:48 +00:00

Comparisons between ClamAV and YARA:

Feature	ClamAV	YARA
Primary use case	Detect known malware, trojans, infected binaries or webshells using a massive prebuilt signature database	Detect custom or suspicious code patterns (webshells, obfuscation, insecure snippets) that you define yourself
Signatures source	Comes with its own maintained virus definition DB (download via `freshclam`)	You write or import `.yar` rule files manually
Scope	Binary files, email attachments, generic malware	Source code, scripts, config files, anything text-based
Ease of use	Very easy: `clamscan /path` or `clamd` daemon	Slightly higher learning curve, but extremely flexible
False positives	Low, but misses novel or obfuscated attacks	Depends on your rules; can detect very specific threats
Integration for OCF	Great for quick file upload checks (“is this file malicious?”)	Great for deeper inspection of PHP, JS, or plugin code (“is this suspicious?”)
Extensibility	Limited to what’s in the database	Completely customizable (you can write rules that fit OCF’s threat patterns)

## **Comparisons between ClamAV and YARA:** | Feature | **ClamAV** | **YARA** | | ----------------------- | ----------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- | | **Primary use case** | Detect *known* malware, trojans, infected binaries or webshells using a massive prebuilt signature database | Detect *custom or suspicious code patterns* (webshells, obfuscation, insecure snippets) that **you define yourself** | | **Signatures source** | Comes with its own maintained virus definition DB (download via `freshclam`) | You write or import `.yar` rule files manually | | **Scope** | Binary files, email attachments, generic malware | Source code, scripts, config files, anything text-based | | **Ease of use** | Very easy: `clamscan /path` or `clamd` daemon | Slightly higher learning curve, but extremely flexible | | **False positives** | Low, but misses novel or obfuscated attacks | Depends on your rules; can detect very specific threats | | **Integration for OCF** | Great for quick file upload checks (“is this file malicious?”) | Great for deeper inspection of PHP, JS, or plugin code (“is this *suspicious*?”) | | **Extensibility** | Limited to what’s in the database | Completely customizable (you can write rules that fit OCF’s threat patterns) |

nini.b-612 commented

2025-10-15 00:34:35 +00:00

ClamAV

Based on our objectives, we'd use ClamAV for broad, automated “known malware” screening at upload time
This tool answers the question: “Has this file been seen in the wild as malware?”
More tailored to quick, general malware filtering

YARA

Based on our objectives, we'd use YARA for custom, code-specific detection of suspicious behavior (e.g., PHP shells, eval(base64), etc.) that commonly affect WordPress uploads.
This tool answers the question: “Does this file look like a PHP backdoor or insecure script?”
More tailored to being used as our core policy and insight tool — the one that drives understanding and prevention.

In general, for the purposes of our project goals...

YARA is the better long-term fit, because:

You can define rules tailored to WordPress vulnerabilities and OCF’s past incidents.
You can evolve the rule set over time as you learn what students upload.
It complements the logging system beautifully (since YARA’s output is textual and can feed directly into Loki).

## **ClamAV** - Based on our objectives, we'd use ClamAV for broad, automated “known malware” screening at upload time - This tool answers the question: “Has this file been seen in the wild as malware?” - More tailored to quick, general malware filtering ## **YARA** - Based on our objectives, we'd use YARA for custom, code-specific detection of suspicious behavior (e.g., PHP shells, eval(base64), etc.) that commonly affect WordPress uploads. - **This tool answers the question: “Does this file look like a PHP backdoor or insecure script?”** - More tailored to being used as our core policy and insight tool — the one that drives understanding and prevention. ## In general, for the purposes of our project goals... **YARA is the better long-term fit, because:** - You can define rules tailored to WordPress vulnerabilities and OCF’s past incidents. - You can evolve the rule set over time as you learn what students upload. - It complements the logging system beautifully (since YARA’s output is textual and can feed directly into Loki).

nini.b-612 commented

2025-10-15 04:32:53 +00:00

Meeting 3 Notes:

Look into preset online rule sets for YARA, specifically catered to Wordpress
We can implement YARA with these rules once the Docker is done

### Meeting 3 Notes: - Look into preset online rule sets for YARA, specifically catered to Wordpress - We can implement YARA with these rules once the Docker is done

nini.b-612 commented

2025-10-21 23:51:57 +00:00

Links to Preset YARA Rules for Detecting WordPress (& Other Resources):

### Links to Preset YARA Rules for Detecting WordPress (& Other Resources): - [Preset Rules on GitHub](https://github.com/pressidium/pressidium-yara-rules) - [YARA Rules Guide: What They Are & How to Write Them](https://www.veeam.com/blog/yara-rules-malware-detection-analysis.html) - [YARA's Documentation](https://yara.readthedocs.io/en/latest/) - [How to Write YARA Rules that Minimize False Positives](https://intezer.com/blog/yara-rules-minimize-false-positives/)

This repo is archived. You cannot comment on issues.

2 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Committee/Secure-OCF-Web-Hosting#10