Building Your First YARA Rule: Detecting Cobalt Strike Beacons

Prerequisites

• YARA installed (apt install yara on Ubuntu/Debian or download from https://virustotal.github.io/yara/)
• A hex editor (optional but helpful - xxd works great)
• Basic understanding of hexadecimal
• Sample files to test against (we'll use safe test strings)

What We're Building

Cobalt Strike beacons contain a configuration block that starts with a specific XOR-encoded pattern. We'll write a YARA rule that detects this pattern, teaching you string matching, hex patterns, and condition logic along the way.

Step 1: Create Your Rule File

Create a new file called cobalt_strike.yar:

bash copy
touch cobalt_strike.yar

Every YARA rule follows this structure:

yara copy
rule RuleName
{
    meta:
        // Metadata about the rule
    strings:
        // Patterns to search for
    condition:
        // Logic determining when rule matches
}

Step 2: Add Metadata

Open your file and add metadata describing what this rule does:

yara copy
rule CobaltStrike_Beacon_Config
{
    meta:
        description = "Detects Cobalt Strike beacon configuration blocks"
        author = "Your Name"
        date = "2025-01-18"
        threat_level = "high"
        reference = "https://www.cobaltstrike.com/"

Metadata doesn't affect matching—it's documentation for humans and SIEM systems.

Step 3: Define String Patterns

Cobalt Strike configs often contain specific byte sequences. Add the strings section:

yara copy
    strings:
        // MZ header for PE files (beacons are often DLLs/EXEs)
        $mz = "MZ"
        
        // Typical beacon config XOR key patterns (0x69, 0x2e common)
        $config_marker = { 00 01 00 01 00 02 }
        
        // Common beacon settings strings (may be obfuscated)
        $setting1 = "www6." ascii wide
        $setting2 = ".stage." ascii wide
        
        // Hex pattern for config block structure with wildcards
        $config_block = { 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? }

Key concepts:

• ascii matches ASCII strings
• wide matches UTF-16LE (Windows Unicode)
• { } defines hex patterns
• ?? is a wildcard matching any byte

Step 4: Write the Condition

Conditions determine when all those strings add up to a match:

yara copy
    condition:
        // File must start with MZ (PE file)
        $mz at 0 and
        
        // Must have the config marker
        $config_marker and
        
        // At least one setting string
        ($setting1 or $setting2) and
        
        // Config block present
        $config_block and
        
        // Reasonable file size (beacons are typically 100KB-500KB)
        filesize > 50KB and filesize < 2MB
}

The at 0 modifier means the string must appear at file offset 0.

Step 5: Test Your Rule

Create a test file that should NOT match:

bash copy
echo "This is a harmless test file" > clean.txt

Run YARA:

bash copy
yara cobalt_strike.yar clean.txt

No output means no match—perfect! Now create a file that WILL match:

bash copy
printf 'MZ\x00\x01\x00\x01\x00\x02www6.' > test_beacon.bin
printf '\x00\x00\x42\x42\x00\x00\x00\x00\x00\x00\x13\x37' >> test_beacon.bin

Test again:

bash copy
yara cobalt_strike.yar test_beacon.bin

You should see:

CobaltStrike_Beacon_Config test_beacon.bin

Step 6: Scan Multiple Files

YARA can scan entire directories recursively:

bash copy
# Scan all files in current directory
yara -r cobalt_strike.yar .

# Scan with string matches shown
yara -s cobalt_strike.yar test_beacon.bin

The -s flag shows which strings matched where.

Step 7: Performance Tips

For faster scanning, add this to your rule condition:

yara copy
    condition:
        // Quick rejection: check MZ header first
        $mz at 0 and
        // ... rest of conditions

YARA evaluates conditions left-to-right and short-circuits, so put fast checks first.

Common Pitfalls

1. Case sensitivity: "CobalT" won't match "cobalt". Use nocase modifier: $str = "cobalt" nocase
2. Forgetting wildcards: Real malware varies. Use ?? for flexible patterns.
3. Overly specific rules: Too many strings = high false negative rate.

Where to Go Next

• Study real YARA rules: https://github.com/Yara-Rules/rules
• Learn about pe module for scanning PE headers specifically
• Try math module for entropy detection (packed malware)
• Practice with malware samples from https://malshare.com (be careful!)
• Read "The Art of YARA" documentation
• Use yarGen tool to auto-generate rules from malware samples

YARA is incredibly powerful for threat hunting across filesystems, memory dumps, and network traffic. This foundational skill will serve you in incident response, malware analysis, and threat intelligence roles.