100 Days of YARA – Day 10: WinSock

This rule will find files utilizing WinSock. A match for this rule would indicate that the sample is likely able to communicate over the network.

As stated in Microsoft’s documentation, The WSAStartup function is called to initiate use of WS2_32.dll.https://docs.microsoft.com/en-us/windows/win32/winsock/initializing-winsock

rule winsock
		description = "Utilizes Winsock"
		reference = "https://docs.microsoft.com/en-us/windows/win32/winsock/initializing-winsock"

		$ = "WSAStartup" ascii wide
		$ = "ws2_32.dll" ascii wide nocase

		any of them

YARA Rules Index

2 thoughts on “100 Days of YARA – Day 10: WinSock

  1. Pingback: YARA Rules Index – DMFR SECURITY

  2. Pingback: Week 01 – 2022 – This Week In 4n6

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s