In yesterday’s post I covered an example of a YARA rule from AT&T’s Alien Labs used to detect payloads used by BlackCat Ransomware. Today I’ll take a quick look at one of the YARA rules used by Apple in XProtect to help protect macOS devices.
Apple’s XProtect uses YARA rules to deliver “signature-based detection and removal of malware” as described in their security guide Protecting against malware in macOS.
On my version of macOS these signatures are located in /Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Resources/XProtect.yara . In this file Apple uses a technique called private rules to define reusable YARA rules that can be references in the conditions of other rules.
For example, one of these rules identifies Portable Executables:
private rule PE
{
meta:
description = "private rule to match PE binaries"
condition:
uint16(0) == 0x5a4d and uint32(uint32(0x3C)) == 0x4550
}This rule is a little different from the condition uses in yesterday’s BlackCat rule that just used uint16(0) == 0x5A4D to identify the executable. Here the rule Apple are using does a couple of lookups to identify that this is a PE file using specific offsets defined in the PE file format specification:
After the MS-DOS stub, at the file offset specified at offset 0x3c, is a 4-byte signature that identifies the file as a PE format image file. This signature is “PE\0\0” (the letters “P” and “E” followed by two null bytes).
PE Format
If you are interested in seeing how Apple identifies MACH-0 files (executable format used by macOS and iOS) they also have a private rule to do that as well:
private rule Macho
{
meta:
description = "private rule to match Mach-O binaries"
condition:
uint32(0) == 0xfeedface or uint32(0) == 0xcefaedfe or uint32(0) == 0xfeedfacf or uint32(0) == 0xcffaedfe or uint32(0) == 0xcafebabe or uint32(0) == 0xbebafeca
}These private rules can be used within the condition sections of the public rules that XProtect also uses. For example in the XProtect_MACOS_51f7dde rule we can see that the rules condition first references the Macho private rule, an upper bound on file size, and then the presence of multiple strings (that were defined using the Hexadecimal format in the strings section above):
rule XProtect_MACOS_51f7dde
{
meta:
description = "MACOS.51f7dde"
strings:
$a = { 63 6F 6D 2E 72 65 66 6F 67 2E 76 69 65 77 65 72 }
$b = { 53 6D 6F 6B 65 43 6F 6E 74 72 6F 6C 6C 65 72 }
$c1 = { 75 70 64 61 74 65 53 6D 6F 6B 65 53 74 61 74 75 73 }
$c2 = { 70 61 75 73 65 53 6D 6F 6B 65 3A }
$c3 = { 72 65 73 75 6D 65 53 6D 6F 6B 65 3A }
$c4 = { 73 74 6F 70 53 6D 6F 6B 65 3A }
condition:
Macho and filesize < 2MB and all of them
}This shows how commonly used elements of a rule can be defined separately and then composed with other conditions to simplify the resulting rules.