wafaray: Enhance your malware detection with WAF + YARA

by do son · December 14, 2022

Enhance your malware detection with WAF + YARA (WAFARAY)

WAFARAY is a LAB deployment based on Debian 11.3.0 (stable) x64 made and cooked between two main ingredients WAF + YARA to detect malicious files (e.g. webshells, viruses, malware, binaries) typically through web functions (upload files).

Purpose

In essence, the main idea came to use WAF + YARA (YARA right-to-left = ARAY) to detect malicious files at the WAF level before WAF can forward them to the backend e.g. files uploaded through web functions see.

When a web page allows uploading files, most of the WAFs are not inspecting files before sending them to the backend. Implementing WAF + YARA could provide malware detection before WAF forwards the files to the backend.

Do malware detection through WAF?

Yes, one solution is to use ModSecurity + Clamav, most of the pages call ClamAV as a process and not as a daemon, in this case, analysing a file could take more than 50 seconds per file. See this resource.

Do malware detection through WAF + YARA?

🙁 A few clues here Black Hat Asia 2019 please continue reading and see below our quick LAB deployment.

WAFARAY: how does it work?

Basically, It is a quick deployment (1) with pre-compiled and ready-to-use YARA rules via ModSecurity (WAF) using a custom rule; (2) this custom rule will perform an inspection and detection of the files that might contain malicious code, (3) typically web functions (upload files) if the file is suspicious will reject them receiving a 403 code Forbidden by ModSecurity.

✔️ The YaraCompile.py compiles all the yara rules. (Python3 code)
✔️ The test.conf is a virtual host that contains the mod security rules. (ModSecurity Code)
✔️ ModSecurity rules calls the modsec_yara.py in order to inspect the file that is trying to upload. (Python3 code)
✔️ Yara returns two options 1 (200 OK) or 0 (403 Forbidden)

Main Paths:

Yara Compiled rules: /YaraRules/Compiled
Yara Default rules: /YaraRules/rules
Yara Scripts: /YaraRules/YaraScripts
Apache vhosts: /etc/apache2/sites-enabled
Temporal Files: /temporal

Approach

Blueteamers: Rule enforcement, best alerting, malware detection on files uploaded through web functions.
Redteamers/pentesters: GreyBox scope, upload, and bypass with a malicious file, rule enforcement.
Security Officers: Keep alerting, threat hunting.
SOC: Best monitoring about malicious files.
CERT: Malware Analysis, Determine new IOC.