Lion Cipher Lab

Write a YARA rule that generalizes to a malware family without false-positiving on goodware — and measure it

• Threat Intel Analyst
• Advanced
• ~75 min
• Free · no account required

Why it matters

Anyone can write a YARA rule that matches the one sample in front of them — paste a unique string from the binary into `strings:`, set the condition to that string, done. It will match that file forever. It will also be useless, because the next build of the same malware changes that string, and some unrelated benign program somewhere contains it too. The entire craft of detection engineering lives in the gap between 'this rule matches THIS file' and 'this rule catches the whole FAMILY and stays quiet on everything else.' That property is GENERALIZATION, and it is not something you can…

What you'll learn

• the difference between a rule that MATCHES a sample and a rule that GENERALIZES to a family — and why the second is the only one worth shipping
• building a synthetic, reproducible test corpus: a 'malware family' that shares real family-like traits plus a 'goodware' set engineered to bait false positives
• showing a NAIVE rule fail in both directions at once — false negatives across variants and false positives on a benign lookalike — from measured evidence, not intuition
• engineering a generalizing rule: multiple weighted strings with `2 of them`, a wildcarded hex code stub, and filesize + type guards, with a reason for every choice
• MEASURING a rule against both sets and reporting true positives / false positives / false negatives — the step most rule-writers skip and the whole point of this lab
• the failure mode of auto-generated (yarGen-style) rules — over-fit strings, compiler/packer artifacts, PE-header-only matches — and how to PRUNE one into something that generalizes
• the named signature-engineering failure modes: over-fitting to one sample, matching compiler/library/packer artifacts, PE-header-only matches, unbounded regex catastrophic backtracking, and no filesize/type guard
• the judgment call: when NOT to write a YARA rule at all, and when a file hash or a behavioral detection is the better control (Pyramid of Pain: strings are trivially bypassed)

Steps in this lab

1. The real problem: matching a sample vs. generalizing to a family
2. Install yara and build the test corpus: a synthetic family and its goodware lookalikes
3. Write the naive rule and watch it fail in BOTH directions
4. Engineer the generalizing rule — and justify every choice
5. MEASURE it: count true positives, false positives, false negatives
6. Auto-generated rules: how yarGen over-fits, and how to prune it
7. The named failure modes, said plainly
8. Judgment: when NOT to write a YARA rule at all
9. The way a pro does it — and what you actually built

Open the full interactive lab →