Factual-rules-generator is an open source project which aims to generate YARA rules about installed software from a running operating system.
The goal of the software is to be able to use a set of rules against collected or acquired digital forensic evidences and find installed software in a timely fashion.
The software can be used to baseline known software from Windows system and create a set of rules for finding similar installation on other systems.
PyInstaller (to change client.py to client.exe)
- On Ubuntu:
sudo apt-get install build-essential libffi-dev python3 python3-dev python3-pip libfuzzy-dev
pip install ssdeep
- On Ubuntu:
Some tools are required on the host operating system some are Unix standard tools and some additional ones:
For the Windows virtual machine, the following software is required to be installed:
- Install all Python dependencies defined requirements.txt
- Create a shared folder to communicate with VM
- Install a Windows VM
etc/allVariables.pyto match your desired configuraiton
test/ some examples of software to install is given, the following specific format is required:
- First, select the name of the packages to install using chocolatey before
:, or the name of the file in case of msi or exe file.
- Second, after
:there’s the name of the exe to extract and run it (without extension).
- The second part after
,follow the same system with the word
installerfirst and after
:the type of installer :
- Finally, the third part,
:and the uninstaller like choco, msiexec or exe
Run and generate the rules
bin/Generator.pyis the only script to run, don’t forget to update
Public YARA rules repository
- factual-rules – Sample rules generated from some very common software.
Overview of factual rules generator
generator – workflow” src=”https://github.com/CIRCL/factual-rules-generator/raw/main/img/StructureAutoGene.png?raw=true” style=”max-width: 100%;”/>
Factual-rules-generator is an open source project which aims to generate YARA rules about installed software from a machine.
Copyright (C) 2021-2022 David Cruciani
Copyright (C) 2021-2022 CIRCL - Computer Incident Response Center Luxembourg
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Affero General Public License for more details.
You should have received a copy of the GNU Affero General Pub lic License
along with this program. If not, see <http://www.gnu.org/licenses/>.