YARA Hunt: One Rule, Zero False Positives
YARA Hunt: One Rule, Zero False Positives
Write a YARA rule that catches every build of one program and none of its look-alikes, tested live with the real YARA engine.
Briefing
Detection engineers write YARA rules that find one family of files in a sea of others. A rule that misses a variant lets it through; a rule that fires on the wrong file floods analysts with false alarms. Both are failures.
Your corpus holds 13 real, official files from the PuTTY project: the terminal client (putty.exe) in six builds across four years and two architectures, and seven sibling tools from the same suite (plink, pscp, psftp, pageant, puttygen). The siblings share most of their code and text with the client, which is exactly what makes them good decoys.
Write one rule that matches every client build and none of the siblings. The tester on this page runs your rule with the real YARA engine (the same library CyberChef uses), right in your browser.
Topics you practise
Evidence
PuTTY release archive (official)
The corpus files come from these official releases, checked against the published SHA-256 lists. Download any of them to study the strings locally. (1 to 1.7 MB each)
Source: PuTTY official releases (Simon Tatham). MIT licence.
Suggested tools: the rule tester on this page, strings or FLOSS, a hex editor, YARA on your own machine (optional).
Run the starter rule unchanged (it looks for the text "PuTTY"). How many of the 13 corpus files does it match?
Format: a number.
Windows programs often store text as UTF-16LE, two bytes per character. Which YARA string modifier makes a text string match that encoding?
Format: one keyword.
A good rule first checks that the file is a Windows executable. Write the condition that tests for the MZ header at offset 0.
Format: a YARA condition expression.
Compare the printable strings of the 0.83 x64 files. Which sibling tool shares the most strings with putty.exe, making it the hardest decoy?
Format: the tool name.
Which YARA condition requires every string defined in the rule to be present?
Format: the condition keywords.
Write one rule that matches all 6 PuTTY client builds and none of the 7 sibling tools. Test it until every file is green.
Each task is worth 100 points: minus 15 per wrong answer and 25 for a hint (never below 40). Finish when you are done; 6 unsolved tasks score 0. Your progress is saved on this device.