YARA

YARA#

YARA is “the pattern matching swiss knife for malware researchers”. A YARA rule describes a family of files using textual or binary patterns; the YARA engine scans files, processes, or memory and reports which rules match.

Used by VirusTotal, MISP, Volatility, every major EDR, and most malware analysts. The de-facto standard for malware classification.

A Minimal Rule#

rule SuspiciousPowerShell
{
  meta:
    author      = "operator"
    date        = "2026-04-27"
    description = "PowerShell with hidden window + base64"
    reference   = "https://example.com/report"
    severity    = "high"

  strings:
    $hidden  = "-WindowStyle Hidden"     ascii wide nocase
    $b64     = "FromBase64String"        ascii wide nocase
    $iex     = "Invoke-Expression"       ascii wide nocase

  condition:
    2 of them
}

Sections#

A YARA rule is three named sections plus a header. Meta is descriptive, strings is the pattern bank, and condition is the boolean expression that decides whether the rule fires. Together they let one short file describe a malware family precisely enough to scan a SOC’s whole sample corpus.

  • meta, key/value metadata; not used for matching.

  • strings, the patterns to look for. Three types:

    • Text: $a = "string".

    • Hex: $h = { 4D 5A ?? ?? ?? ?? ?? ?? ?? ?? }.

    • Regex: $r = /\bcurl\s+http/.

  • condition, Boolean expression that decides match. Can reference string identifiers, counts, file size, modules.

String Modifiers#

Modifiers tune how a single string pattern matches. Width modifiers (ascii / wide) cover the encoding axis; nocase and fullword constrain matches; xor and base64 brute-force common obfuscations. Picking the correct mix is the difference between a fragile rule and a durable one.

Modifier

Effect

ascii

ASCII (default if neither specified)

wide

UTF-16LE (Windows binaries)

ascii wide

both

nocase

case-insensitive

fullword

match only with non-alphanumeric boundaries

xor(0-255)

brute-force XOR-key

base64

match base64-encoded variants

Conditions#

The boolean expression that decides whether a rule fires. The syntax goes well past plain $a and $b: counts, offsets, file-size constraints, of quantifiers over string sets, and externally-supplied variables let one rule capture a malware family with surgical precision.

  • $a, “rule matches if $a is found”.

  • 2 of them, at least 2 of the strings.

  • all of ($a*), all strings starting with $a.

  • filesize < 1MB.

  • $mz at 0, match at a specific offset.

  • #a > 5, count of occurrences of $a > 5.

  • External variables, modules (pe, elf, hash, cuckoo, magic, math).

The PE / ELF Modules#

YARA’s superpower for binaries is the structural module library.

import "pe"

rule SignedExe
{
  condition:
    pe.is_pe and
    pe.number_of_signatures > 0 and
    pe.imphash() == "8b3e89c..."
}

The pe module exposes section names, imports, exports, signatures; elf does the same for Linux binaries. Match on structure, not just bytes.

Running YARA#

The CLI is small. The interesting flags are -r for recursive scanning of a directory, -p for parallelism, -s to print which strings matched, and -d to inject external variables that condition expressions can reference. YARA-X is the Rust rewrite to default to in 2026 pipelines.

$ yara rules.yar suspicious.exe
$ yara -r rules.yar /samples/
$ yara -p 4 rules.yar /samples/
$ yara -s rules.yar suspicious.exe
$ yara -d malware_severity=5 rules.yar ...

YARA-X is a Rust rewrite, faster, safer, mostly compatible. Worth adopting for new pipelines.

Where YARA Shows Up#

YARA’s reach extends well past one operator’s command line. VirusTotal, EDR vendors, memory forensics tools, email security, and threat-intelligence platforms all consume YARA rules natively, which is why investing in rule-writing skill pays back across the whole defensive stack.

  • VirusTotal, Retrohunt and Livehunt scan uploads against your rules.

  • EDR / antivirus, many vendors run YARA rules at the host.

  • Memory forensics, Volatility’s yarascan plugin against memory dumps.

  • Email security, attachments matched against rule sets.

  • MISP / OpenCTI, threat intelligence platforms ship and exchange YARA rules as IOCs.

  • YARA-L, Google Chronicle / SecOps detection language; YARA-influenced.

Best Practices#

The habits that separate a quick rule from a rule worth shipping. Pinning context cuts false positives; combining strings beats single-string matches; benignware testing finds the embarrassing collisions before deployment; and rules under version control with metadata become institutional knowledge.

  • Pin context, filesize, pe.machine, elf.machine cut false positives.

  • Avoid generic single strings, “Invoke-Expression” alone is in every PowerShell tutorial. Combine.

  • Test on benignware, run rules over a clean baseline (Windows System32, Linux /usr/bin) to find false positives.

  • Track provenance, meta fields with author, date, source.

  • Version control rules; review them like code.

Pitfalls#

The traps every YARA author hits at least once. Width modifiers, regex performance, hash brittleness, and the adversary’s awareness of YARA itself all shape how rules age once deployed. Naive matching that worked yesterday breaks on tomorrow’s slightly-obfuscated variant.

  • String width, forgetting wide misses Windows strings; forgetting ascii misses Linux ones.

  • Excessive regex, regex strings are slower than text/hex; use sparingly.

  • Hash-based rules, hash.md5(0, filesize) works but is brittle; prefer behavioral / structural rules.

  • YARA versus reality, attackers know YARA exists; obfuscators break naive string matching. Combine with hashing, behavior, and network signals.

Contents