Spyre is a simple YARA scanner, the main goal is easy operationalization of YARA rules. Comprehensive rule sets are not included.
Spyre is intended to be used as an investigation tool by incident responders with an appropriate skill level. It is not meant to be used as any kind of endpoint protection service.
Using Spyre is easy:
- Add YARA signatures. Per default, filenames matching *.yr, *.yar,
*.yara are recognized, see below how to change that. There are two
options for doing this:
- Put the rule files into the same directory as the binary
- Add the rule files to ZIP file and append that file to the binary.
- Deploy, run the scanner
- Collect report
Run-time options can be either passed via command line parameters or
via file that params.txt. Empty lines and lines starting with the
# character are ignored. Every line is interpreted as a single
command line argument.
If a ZIP file has been appended to the Spyre binary, configuration and other files such as YARA rules are only read from this ZIP file. Otherwise, they are read from the directory into which the binary has been placed.
Some options allow specifying a list of items. This can be done by separating the items using a semicolon.
Set a configuration file. Default: spyre.yaml
Normally (unless this switch is enabled), Spyre instructs the OS scheduler to lower the priorities of CPU time and I/O operations, in order to avoid disruption of normal system operation.
This option sets the hostname that will be used in the log file and in the report.
This option sets the log level. Valid: trace, debug, info, notice, warn, error, quiet.
Set one or more report targets, separated by a semicolon (;).
Default: spyre.log in the current working directory, using the plain
format.
A different output format can be specified by appending
,format=FORMAT. The following formats are currently supported:
plain, the default, a simple human-readable text formattsjson, a JSON document that can be imported into Timesketch
Set one or more specific filesystem paths to scan. Default: / (Unix)
or all fixed drives (Windows).
Set explicit list of YARA rule files. Default: Use *.yr, *.yar,
*.yara` files from current working directory or appended ZIP file.
Set maximum size for files to be scanned using YARA. Default: 32MB
YARA is configured with default settings, plus the following explicit
switches (cf. 3rdparty.mk):
--disable-magic--disable-cuckoo--enable-dotnet
Spyre can be built on a Debian/stretch system (or a chroot) in which the following packages have been installed:
- make
- gcc
- gcc-multilib
- gcc-mingw-w64
- autoconf
- automake
- libtool
- pkg-config
- wget
- sed
- golang-$VERSION-go, e.g. golang-1.8-go. The Makefile will
automatically select the newest version unless
GOROOThas been set. - git-core
Also, go-dep from https://github.com/golang/dep is needed. go install github.com/golang/dep should be sufficiant.
Once everything has been installed, just type make. This should
download archives for musl-libc, openssl, yara, build those and
then build spyre.
The spyre bare binaries are created in _build/<triplet>/.
Running make release creates a ZIP file that contains binaries for
all supported architectures.
- appendedzip, code that tries to find a zip file appended to another file such as the main executable
- zipfs, a read-only filesystem provider for spf13/afero, see also afero PR #146
Hilko Bengen [email protected]
Copyright 2018 Deutsche Cyber-Sicherheitsorganisation GmbH
This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program. If not, see http://www.gnu.org/licenses/.