Section 4.1: Malware Discovery

Question 1

Name the four tools used to detect anomalies inside a system.

Answer 1

Yara, Sigcheck, Capa, and DensityScout.

Question 2

Describe how to use Yara and how can I create rules.

Answer 2

Yara runs by running [-C] followed by the rules file and then <file> where the rules file will run on. If running multiple signature files, they must be referenced by index to the same file being run. To compile a new rule, use yara64.exe.</file>

Question 3

What is DensityScout and what does it do? Is output always malicious?

Answer 3

It scans a filesystem for compressed, encrypted, or packed files and tracks their entropy. Density that is less than 0.1 means its high on density making it an anomaly. Output isn’t always malicious so check the hashes for each file.

Question 4

Command example for searching executables with high density:

Answer 4

Densityscout -pe -r -p -o results.txt C:\Windows\System32.

Question 5

What is Sigcheck used for?

Answer 5

To check if images are digitally signed.

Question 6

What does capa do?

Answer 6

It disassembles the binary code in search for well-known patterns. It can be used to reverse-engineer and the rules are written in YAML. It can connect to ATT&CK. It can also use malfind files from memory.

Question 7

A simple capa command.

Answer 7

Capa.exe -f pe <file></file>