CCCS_YARA.yml

#  CCCS YARA Standard Configuration
#
# --FORMAT--
#  <Metadata Name>:
#    description: <description of the metadata>
#    format: <format of the metadata value>
#    unique: Yes | No | <integer value>
#    optional: Yes | No | Optional
#    validator: <name of validator function defined in "validator_functions.py">
#    argument:
#        fileName: <YAML file>
#        valueName: <value name>
#        regexExpression: <regex expression>
#        child: <name of a child metadata>
#        parent: <name of a parent metadata>
#        <custom parameter>: <name of custom parameter>
#
# --DESCRIPTION--
#  -> unique:
#         - Yes | yes: this metadata metadata name is unique
#         - No | no: this metadata metadata name can be duplicated unlimited times
#         - <integer value>: this metadata metadata name can be duplicated <integer value> times
#  -> optional:
#        - Yes | yes: this metadata metadata is not required by the program and optional in metadata
#        - No | no: this metadata metadata is required by the program and must be in metadata
#        - Optional | optional: this metadata metadata is required by the program but optional in metadata
#                               (validator must auto-generate this metadata if missing from the YARA rule)
#                               (currently only supported by "valid_uuid", "valid_fingerprint", "valid_version",
#                                                                 "valid_first_imported" and "valid_last_modified")
#  -> validator:
#        - <name of validator function defined in "validator_functions.py">: this function will be called to validate the metadata
#  -> argument:
#        - fileName: regex expressions from the given file will be used to validate the metadata (mutually exclusive with regexExpression)
#        - valueName: regex expressions under "valueName" of the given file will be used(mutually exclusive with regexExpression)
#        - regexExpression: provided regex expression will be used to validate the metadata (mutually exclusive with fileName & valueName)
#        - child: name of a child metadata (mutually exclusive with parent)
#        - parent: name of a parent metadata (mutually exclusive with child)
#        - <custom parameter>: any custom parameter that will be passed to the validator as a part of "argument"
#                             (info|exploit|technique|tool|malware and mitre_att below have examples of some arguments
#                             that are passed into facilitate some more complex behaviors)
#
# --NOTE--
# 1. "unique" and "optional" are required fields.
# 2. If "valid_regex" is used as a validator, "fileName"/"valueName" or "regexExpression" must be provided.
# 3. Custom validators should be defined in validator_functions.py and included in self.names of Validators class
# 4. Child metadata create MetadataAttributes instances as temporary place holders in self.required_fields and validators for child metadata
#    should use the place holders to create the actual MetadataAttributes instances in self.required_fields_children of yara_validator.py (YaraValidator class).
# 5. There are reserved parameters for "argument" such as fileName, valueName, regexExpression, child, parent and child_place_holder
#
# --EXAMPLE--
# metadata_1:
#   description: 'this is metadata1'
#   format: 'hex string'
#   unique: Yes
#   optional: Yes
#   validator: valid_metadata_1
#
# metadata_2:
#   description: 'this is metadata2'
#   format: 'unvalidated'
#   unique: No
#   optional: Optional
#   validator: valid_regex
#   argument:
#      fileName: CCCS_YARA_values.yml
#      valueName: unvalidated_regex
#
# metadata_3:
#   description: 'this is metadata3'
#   format: 'lowercase_author@uppercase_organization or uppercase_organization'
#   unique: 3
#   optional: No
#   validator: valid_regex
#   argument:
#     regexExpression: ^[a-zA-Z]+\@[A-Z]+$|^[A-Z]+$

---
id:
   description: "Autogenerated unique identifier based on RFC 4122 if a uuid is not already present"
   format: "Base 62 conversion of UUID"
   unique: Yes
   optional: Optional
   validator: valid_uuid

fingerprint:
   description: "Autogenerated based on SHA256 hash of string values and the condition statement of the YARA rule"
   format: "hex string"
   unique: Yes
   optional: Optional
   validator: valid_fingerprint

version:
   description: "Revision of the rule, autogenerated as 1.0 if no present"
   format: "x.x"
   unique: Yes
   optional: Optional
   validator: valid_version

score:
   description: "Percentage of confidence in the rule."
   format: integer
   unique: Yes
   optional: Yes
   validator: valid_percentage

minimum_yara:
   description: "Minimum version of Yara to run the rule"
   format: "x.x"
   unique: Yes
   optional: Yes
   validator: valid_version

date:
   description: "Date stamp of when the rule was created"
   format: "YYYY-MM-DD"
   unique: Yes
   optional: Yes
   validator: valid_date

modified:
   description: "Last modified date"
   format: "YYYY-MM-DD"
   unique: Yes
   optional: Optional
   validator: valid_date

tags:
   description: "A set of keywords relevant to the rule"
   format: unvalidated
   unique: No
   optional: Yes
   validator: None

status:
   description: "Status of the rule as assigned by the submitter"
   format: "uppercase"
   unique: Yes
   optional: No
   validator: valid_regex
   argument:
      fileName: CCCS_YARA_values.yml
      valueName: rule_statuses
      regexExpression:

sharing:
   description: "Sharing limitation"
   format: "uppercase"
   unique: Yes
   optional: No
   validator: valid_regex
   argument:
      fileName: CCCS_YARA_values.yml
      valueName: sharing_classifications

source:
   description: "Source organization of the YARA rule"
   format: "uppercase"
   unique: Yes
   optional: No
   validator: valid_source

author:
   description: "Author and organization"
   format: "lowercase_author@uppercase_organization or uppercase_organization"
   unique: No
   optional: No
   validator: valid_regex
   argument:
      regexExpression: ^[a-zA-Z]+\@[A-Z]+$|^[A-Z\s._-]+$|^.*$

description:
   description: "The description of the rule"
   format: ".*"
   unique: Yes
   optional: No
   validator: valid_regex
   argument:
      regexExpression: ".*"

category:
   description: "Detection category"
   format: "uppercase"
   unique: Yes
   optional: No
   validator: valid_category
   argument:
      child: info|exploit|technique|tool|malware

info|exploit|technique|tool|malware:
   description: "Specific information about the category.
      if_key_gen_mitre_att: is used to define which keys will been used to generate mitre_att software ids
      mitre_softwareid_gen: is an array that will be used during runtime to store software ids generated,
      this will be compared with mitre_softwareid_found and values not found there
      will be generated"
   format: "uppercase"
   unique: No
   optional: Yes
   validator: valid_category_type
   argument:
      parent: category
      generate_mitre_att_from: ^tool$|^malware$

malware_type:
   description: "Give an indication as to what the capability/purpose of the malware is"
   format: "uppercase"
   unique: No
   optional: Yes
   validator: valid_regex
   argument:
      fileName: CCCS_YARA_values.yml
      valueName: malware_types

mitre_att:
   description: "Any valid MITRE ATT&CK ID codes
      mitre_softwareid_found: is an array that will be used during runtime to store software ids found"
   format: "'TA####'|'T####'|'M####'|'G####'|'S####'"
   unique: No
   optional: Yes
   validator: valid_mitre_att

actor_type:
   description: "The type of the actor"
   format: "uppercase"
   unique: 2
   optional: Yes
   validator: valid_regex
   argument:
      fileName: CCCS_YARA_values.yml
      valueName: actor_types

actor:
   description: "Actor name as stated by the source"
   format: "uppercase"
   unique: Yes
   optional: Yes
   validator: valid_actor
   argument:
      child: mitre_group
      required: actor_type

mitre_group:
   description: 'Autogenerated alias of the actor value based on the "https://attack.mitre.org/groups/" standard'
   format: "uppercase"
   unique: Yes
   optional: Yes
   validator: mitre_group_generator
   argument:
      parent: actor

report:
   description: "Report linked to this rule"
   format: ".*"
   unique: No
   optional: Yes
   validator: valid_regex
   argument:
      fileName: CCCS_YARA_values.yml
      valueName: universal_regex

reference:
   description: "Reference for the rule i.e. weblink, report, individual, etc."
   format: "unvalidated"
   unique: No
   optional: Yes
   validator: valid_regex
   argument:
      fileName: CCCS_YARA_values.yml
      valueName: unvalidated_regex

hash:
   description: "Sample hash"
   format: "lowercase MD5, SHA, or SHA-256"
   unique: No
   optional: Yes
   validator: valid_regex
   argument:
      fileName: CCCS_YARA_values.yml
      valueName: hash_types

vol_script:
   description: "Used by the Reverse Engineering team"
   format: "unvalidated"
   unique: Yes
   optional: Yes
   validator: None

al_*:
   description: "Assembly Line specific metadata added for internal Assembly Line use"
   format: "unvalidated"
   unique: Yes
   optional: Yes
   validator: None

credit:
   description: "Used when the autor would like credit for the rule"
   format: "unvalidated"
   unique: No
   optional: Yes
   validator: None

original_*:
   description: "For rules converted from other sources so that we preserve the original metadata"
   format: "unvalidated"
   unique: No
   optional: Yes
   validator: None