InQuest's yara-rules repository publishes the company's research-grade YARA signatures for detecting malicious Office documents, encoded PowerShell, embedded payloads and exploit artifacts during authorized threat hunting.
| Tool | InQuest/yara-rules — a curated collection of research-grade YARA signatures for malware and malicious document hunting |
| Category | Detection engineering / threat hunting signatures |
| Primary Use | Scanning file collections and malware corpora with YARA to identify malicious Office documents, encoded PowerShell, SLK/IQY lures and embedded PE payloads |
| Safe Use | Intended for research and hunting purposes on samples and datasets you are authorized to analyze, such as internal SOC triage, malware research labs and defensive retro-hunts; the README explicitly warns the rules are not production appropriate |
| Telemetry Note | Purely a signature corpus, not a tool that touches the network; defenders should validate each rule against their own corpus and expect false positives before deploying to production EDR or SIEM pipelines |
yara-rules is a long-running repository from the threat research team at InQuest, collecting the YARA signatures they develop during incident-driven research and wish to share publicly. The README is unusually explicit about the intended maturity level: these rules "should not be considered production appropriate" and are instead positioned as "valuable for research and hunting purposes." That framing matters for anyone planning to drop the corpus straight into an EDR deployment, because research-grade rules are typically tuned for recall over precision, written against a specific campaign or obfuscation family rather than a broad baseline of benign enterprise files.
The repository sits at roughly 389 stars, is licensed under MIT, is tagged with threat-hunting, yara, yara-rules and yara-signatures, and follows a deliberately flat layout: individual .rule files at the repository root, each named after the technique or threat it detects, plus a labs.inquest.net subdirectory containing VirusTotal Intelligence hunt rules that feed the InQuest Labs data portal. There is no packaging, no installer and no driver code — the product is the signatures themselves, consumed by whatever YARA engine your workflow already uses, whether that is yara on the command line, a retrospective scanner over an archive, or a VirusTotal retro-hunt.
The dominant theme across the collection is malicious document detection, which tracks InQuest's heritage in file inspection and email-borne threat analysis. Several rules target Excel 4.0 macro (XLM) abuse, a resurgence-era technique that legacy macro defenses routinely miss. Excel_Hidden_Macro_Sheet.rule flags hidden macro sheets, Microsoft_XLSX_with_Macrosheet.rule catches modern XLSX files carrying macrosheets — the technique documented in their Zloader 4.0 research — and Symbolic_Link_Files_Macros_File_Characteristic.rule detects SLK symbolic link files containing Excel 4.0 macros, a trick publicized by Outflank's Stan Hegt. Each entry links back to the originating blog post, giving analysts the full analytical context behind the byte patterns.
Another cluster addresses old-but-persistent Microsoft Office features abused for execution and pivoting. Microsoft_Office_DDE_Command_Execution.rule covers the DDE macro-less command execution wave of 2017, and the README anchors it to four separate blog analyses of real lures observed in the wild. IQY_File.rule, IQY_File_With_Suspicious_URL.rule and IQY_File_With_Pivot_Extension_URL.rule handle Excel web query files used to make victim machines fetch remote content, while MSIExec_Pivot.rule detects executables converted to MSI packages that abuse Custom Action Type 19 to invoke msiexec as a download pivot. Microsoft_Excel_Data_Connection.rule extends coverage to hidden sheets and data connections as a follow-on exfiltration channel.
A set of rules targets encoded and embedded payload staging. Base64_Encoded_Powershell_Directives.rule and Hex_Encoded_Powershell.rule catch encoded PowerShell launchers inside documents, with the hex variant accompanied by a mixed-case regex generator hosted on InQuest Labs — a useful detail, since attackers frequently defeat naive matching simply by alternating hex case. Embedded_PE.rule is a structural rule that discovers PE executables embedded in carrier files without relying on header strings that are trivially stripped or modified, illustrating the more durable, format-aware style the repo favors over fragile string matching.
Several signatures are tied to specific vulnerabilities and threat actors. The CVE-2018-4878 set includes three complementary rules covering the Adobe Flash DRM use-after-free exploited in the wild, along with a rule for Office documents embedding Flash files — a useful pre-detonation indicator even after Flash's retirement. RTF_Byte_Nibble_Obfuscation.rule detects the RTF parser trick documented by Kaspersky's Boris Larin, a rarely seen obfuscation that was used in the CVE-2018-8174 in-the-wild 0day distribution. Signed_Executable_With_Custom_Elliptic_Curve_Parameters.rule addresses CVE-2020-0601, the "Curveball" ECC spoofing flaw, by flagging signed executables using an explicit curve. GlowSpark_Downloader.rule detects a second-stage Actinium downloader documented in 2022, showing the repo still receives fresh campaign-driven additions.
One rule deserves particular attention from defenders handling credential-leak scenarios: NTLM_Credentials_Theft_via_PDF_Files.rule detects Adobe PDF files referencing a remote UNC object, a technique researched by Check Point that causes NTLM hash leakage when the crafted PDF is opened. This is a good example of the collection's breadth beyond Office formats and its habit of crediting original research — in this case linking the source write-up so analysts understand both the detection logic and the underlying abuse mechanism.
The Hidden_Bee_Elements.rule signature covers something more exotic: the Hidden Bee malware family's custom Windows executable format, which abandons the standard PE structure precisely to evade conventional tooling. Detecting custom binary formats with YARA requires structural understanding rather than string matching, and the linked Malwarebytes reversing analysis makes this a genuinely instructive case study for detection engineers who want to understand how signature authors characterize novel file formats.
From a workflow perspective, the repository is best treated as a research corpus and idea library rather than a feed. A sensible authorized pattern is to clone the repo, walk each .rule file alongside its referenced blog post, then validate performance against your own benign file baseline before promoting anything into production detection pipelines. The heavy per-rule citation — to InQuest blogs, third-party research from Securelist, Check Point, Malwarebytes and Outflank, and in several cases hosted sample families — makes this repo as much an annotated index of document-abuse techniques as a signature set.
The README also points to sibling projects that round out the ecosystem: InQuest/yara-rules-vt for VirusTotal-oriented hunting, InQuest/awesome-yara as a curated index of the broader YARA community, the labs.inquest.net research portal for sample lookups, and yaramate.com. For defenders building out malicious-document detection coverage, especially against legacy-format abuse like XLM macros, SLK files and IQY pivots, this collection offers a well-documented starting point written by a team that has spent years doing exactly this class of file forensics.
Getting started is a standard git clone https://github.com/InQuest/yara-rules away, after which any YARA engine can compile the individual .rule files against your authorized sample collections. Given the maintainers' own caveat, treat every hit as a research lead requiring triage rather than a verdict, and expect to tune string-based rules more aggressively than the structural ones. As an educational window into how a professional threat-intel team writes detections — with each rule traceable to a real campaign, technique or public vulnerability — the repository earns its place as a reference corpus for detection engineering and malware analysis training alike.
InQuest/yara-rules.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.