# Spectra Detect YARA Hunting — Custom Rules, Modules, and Worker Sync

> Create and deploy custom YARA rulesets on Spectra Detect Workers with supported modules (PE, ELF, Math, Hash), naming rules, and sync via Spectra Detect Manager.

## Classifying Files with YARA Rules



## Using YARA with Spectra Detect Worker

Default YARA rulesets on the appliance are automatically installed with the Spectra Core static analysis engine. With every engine update, these rulesets are updated as well. The rulesets cannot be saved to the Spectra Intelligence cloud or modified (edited, disabled, or deleted) in any way by any type of user.

Additionally, ReversingLabs publishes open source YARA rules in [a public GitHub repository](https://github.com/reversinglabs/reversinglabs-yara-rules). These rules can be freely downloaded and imported into any Worker.

In addition to default YARA rulesets, the Worker can use custom rulesets created by users. This is available by pulling rulesets from other Spectra Analyze and Worker appliances using [the YARA Sync feature](../Config/YARASync.md) on Spectra Detect Manager.

### Rulesets and restrictions

ReversingLabs products support the following YARA modules:

- PE
- ELF
- Math
- Hash
- Time
- Dotnet

**Note: "Import" and "include" statements are not supported.**


Save custom YARA rulesets as files with the *.yara* extension.

Naming restrictions:

- YARA ruleset names must be between 3 and 48 characters.
- The underscore ( _ ) should be used instead of spaces, and any other special characters should be avoided. Ruleset names should only use numbers (0-9) and a-z/A-Z letters.

**Tip: For more information on writing YARA rulesets, consult one of the following sources:**
- ReversingLabs publishes guidance for using YARA on the official blog. See the blog posts ["Level up your YARA game"](https://blog.reversinglabs.com/blog/level-up-your-yara-game) , ["Writing detailed YARA rules for malware detection"](https://www.reversinglabs.com/blog/writing-detailed-yara-rules-for-malware-detection) and ["Five Uses of YARA"](https://blog.reversinglabs.com/blog/five-uses-of-yara) to learn more.
- The official YARA documentation offers detailed advice on [how to write YARA rules](https://yara.readthedocs.io/en/stable/writingrules.html).
- Use Spectra Core rulesets present on the Spectra Analyze appliance as reference.

## Synchronizing YARA Rulesets via Spectra Detect Manager

In order to synchronize YARA rulesets, the Worker appliance must be connected to a Manager, and YARA syncing must be enabled on that Manager. The worker-c1000 section briefly explains how to connect a Worker to a Manager.

If the Worker is connected to a Manager which has YARA synchronization enabled, rulesets from the Worker will be automatically synchronized with other appliances, and vice-versa. Likewise, when YARA synchronization is disabled on a Manager that Worker is connected to, it will be automatically disabled on the Worker as well.

When YARA synchronization is enabled on a Manager, the Worker will poll it for new and updated rulesets once per minute.

The YARA Sync page on the Manager will display a table of all appliances connected to the Manager and their YARA ruleset synchronization status.

Appliances can show one of the following statuses:

- **In Sync** - The rulesets on the connected appliance match the rulesets on the Manager.
- **Not In Sync** - The connected appliance doesn’t have the newest YARA rulesets.
- **Unknown** - The connected appliance doesn’t have YARA synchronization enabled, or is unreachable.
- **Please Update** - The connected appliance needs to be updated to a newer version before it can show the YARA synchronization status.
- **Please Set To HTTPS** - The appliance is connected to the Manager using the unsupported HTTP protocol. The appliance URL must be updated to `https://` in the *Configure appliance* dialog on the Manager.

Workers will poll the Manager for rule changes every minute. Spectra Analyze appliances will push new rules to the Manager as soon as they are created, and pull new rules every 5 minutes.

**Example case: One Spectra Analyze appliance and one Worker attached to a Manager with YARA Synchronization enabled**

Any YARA ruleset change made on Spectra Analyze will take up to 5 minutes to be synchronized to the Manager. Once the change reaches the Manager, it will take up to 1 minute for the change to be synchronized to the Worker. In total, it will take up to 6 minutes for a change to be synchronized from a Spectra Analyze appliance to a Worker.

Appliances that are *Not In Sync* can be manually synchronized at any time by clicking the *Start YARA Sync* button in the far right column of the table.

Rulesets created on Spectra Analyze appliances before YARA synchronization was enabled won’t synchronize to the Manager until the user changes their status or modifies them in any way. Rules present on the Manager, however, will synchronize to newly connected Spectra Analyze appliances regardless of when they were created.

Apart from new rulesets, changes in existing rulesets will be synchronized as well. If a ruleset is disabled or deleted on one appliance, its status will be distributed to other appliances.

In case of Workers, disabled rulesets will be removed until they are re-enabled on another appliance. When enabled again, those rulesets will be synchronized to the Worker as if they have been newly created. This means that the Worker only contains enabled (synchronizable) rulesets at all times.

## Troubleshooting YARA Issues on the Worker

1. From the Worker appliance status page on the Manager, disconnect the Worker by clicking the *Remove* button.
2. Access the dashboard page and click the *Add new appliance* button.
3. In the *Add new appliance* dialog that opens, select *Spectra Detect Worker* as the appliance type, and fill in the configuration fields with the data of the previously disconnected Worker instance.
4. Click *Submit* to connect the Worker instance to the Manager again.

If the process completes successfully, the YARA Sync page on the Manager should display the status of the Worker instance.
