YARA Rules - YARA mean one! | Advent of Cyber 2025 - Day 13

This guide contains the answer and steps necessary to get to them for the YARA Rules - YARA mean one! room.

Table of contents

• Yara Rules

Yara Rules

1. How many images contain the string TBFC?

   We will create our own YARA rule that will look for the specific string "TBFC". Since there is only one string, it can trigger for any of them.

   rule TBFC_yara_rule
   {
       meta:
           author = "Kevinovitz"
           description = "TBFC Rule"
           date = "2025-10-10"
           confidence = "low"
   
       strings:
           $s1 = “TBFC:”
   
       condition:
           any of them
   }
   

   

   Upon executing the YARA rule, we can see a number of files returned that contain the string.

   yara -r rule.yar /home/ubuntu/Downloads/easter/
   

   

   Click for answer

   5

2. What regex would you use to match a string that begins with TBFC: followed by one or more alphanumeric ASCII characters?

   Next, we want to add a part to our search string. Using regex notation we can include one or more alphanumeric characters as follows:

   rule TBFC_yara_rule
   {
       meta:
           author = "Kevinovitz"
           description = "TBFC Rule"
           date = "2025-10-10"
           confidence = "low"
   
       strings:
           $s1 = /TBFC:[A-Za-z0-9]+/
   
       condition:
           any of them
   }
   

   

   Click for answer

   /TBFC:[A-Za-z0-9]+/

3. What is the message sent by McSkidy?

   Running this script (whilst outputting the found strings) will reveall the secret message we are looking for.

   yara -r rule.yar /home/ubuntu/Downloads/easter/
   

   

   Click for answer

   Find me in HopSec Island