feat: integrate YARA signature-based detection

Author: EfeSidal

.github/workflows/rust.yml

@@ -22,6 +22,9 @@ jobs:
       with:
         components: rustfmt
 
+    - name: Install System Dependencies
+      run: sudo apt-get update && sudo apt-get install -y clang libclang-dev
+
     - name: Check formatting
       run: cargo fmt --check
 

Cargo.lock

@@ -13,3 +13,4 @@ sha2 = "0.10"
 goblin = "0.9"
 regex = "1"
 chrono = "0.4"
+yara = { version = "0.31.0", features = ["vendored"] }

Cargo.toml

@@ -7,6 +7,9 @@ WORKDIR /usr/src/entrors
 # Copy the source code into the container
 COPY . .
 
+# Install dependencies required for YARA (clang, libclang)
+RUN apt-get update && apt-get install -y clang libclang-dev
+
 # Build the project in release mode
 RUN cargo build --release
 

Dockerfile

@@ -64,6 +64,7 @@ struct AnalysisReport {
     suspicious_apis: Vec<String>,
     strings_found: Vec<String>,
     mitre_techniques: Vec<String>,
+    yara_matches: Vec<String>,
 }
 
 #[derive(Debug, Serialize, Clone)]
@@ -190,6 +191,7 @@ fn main() {
             "T1129".to_string(),
             "T1082".to_string(),
         ],
+        yara_matches: scan_with_yara(&file_data),
     };
 
     // Sezgisel Kurallar
@@ -249,6 +251,9 @@ fn calculate_risk_score(report: &mut AnalysisReport) {
         score += 15;
     }
 
+    // YARA matches: +25 each
+    score += (report.yara_matches.len() as u32) * 25;
+
     report.risk_score = score.min(100);
     report.risk_level = match report.risk_score {
         0..=30 => "LOW",
@@ -285,6 +290,37 @@ fn extract_strings(data: &[u8]) -> Vec<String> {
     matches
 }
 
+fn scan_with_yara(data: &[u8]) -> Vec<String> {
+    let mut matches = Vec::new();
+    if let Ok(mut compiler) = yara::Compiler::new() {
+        let rule = r#"
+            rule UPX_Packed {
+                strings:
+                    $upx1 = "UPX0"
+                    $upx2 = "UPX1"
+                condition:
+                    $upx1 and $upx2
+            }
+            rule Suspicious_MZ {
+                strings:
+                    $mz = "MZ"
+                condition:
+                    $mz at 0
+            }
+        "#;
+        if let Ok(compiler) = compiler.add_rules_str(rule) {
+            if let Ok(rules) = compiler.compile_rules() {
+                if let Ok(results) = rules.scan_mem(data, 10) {
+                    for m in results {
+                        matches.push(m.identifier.to_string());
+                    }
+                }
+            }
+        }
+    }
+    matches
+}
+
 fn generate_html_report(report: &AnalysisReport) -> String {
     let color = match report.risk_level.as_str() {
         "LOW" => "#28a745",
@@ -323,6 +359,7 @@ fn generate_html_report(report: &AnalysisReport) -> String {
         <h3>Tespit Edilen Şüpheli API ve Stringler</h3>
         <p><b>APIler:</b> {}</p>
         <p><b>Stringler:</b> {}</p>
+        <p><b>YARA Tespiti:</b> {}</p>
     </div>
     </body></html>"#,
         color,
@@ -333,7 +370,12 @@ fn generate_html_report(report: &AnalysisReport) -> String {
         report.risk_score,
         sections_html,
         report.suspicious_apis.join(", "),
-        report.strings_found.join(", ")
+        report.strings_found.join(", "),
+        if report.yara_matches.is_empty() {
+            "Bulunamadı".to_string()
+        } else {
+            report.yara_matches.join(", ")
+        }
     )
 }
 
@@ -363,6 +405,9 @@ fn render_terminal_report(report: &AnalysisReport) {
     if !report.suspicious_apis.is_empty() {
         println!("       [!] Şüpheli APIler: {:?}", report.suspicious_apis);
     }
+    if !report.yara_matches.is_empty() {
+        println!("       [!] YARA Eşleşmeleri: {:?}", report.yara_matches);
+    }
 }
 
 // ─────────────────────────────────────────────────────────────
@@ -516,9 +561,10 @@ mod tests {
             suspicious_apis: vec!["VirtualAlloc".into()],
             strings_found: vec!["http".into()],
             mitre_techniques: vec![],
+            yara_matches: vec!["UPX_Packed".into()],
         };
         calculate_risk_score(&mut report);
-        assert_eq!(report.risk_score, 20 + 10 + 15); // Packed(20) + API(10) + String(15) = 45
-        assert_eq!(report.risk_level, "MEDIUM");
+        assert_eq!(report.risk_score, 20 + 10 + 15 + 25); // Packed(20) + API(10) + String(15) + YARA(25) = 70
+        assert_eq!(report.risk_level, "HIGH");
     }
 }