YARA glossary
Short definitions of the terms used across the guides and tools.
- Alternation (hex)
- Alternation in a YARA hex string, written ( A | B ), matches one of several byte sequences, which may differ in length.
- Atom
- An atom is the short fixed byte sequence YARA extracts from each pattern and searches for first; atom quality drives scan speed.
- base64 modifier
- The base64 and base64wide modifiers match a YARA string after base64 encoding, including when it sits at any alignment in encoded data.
- Condition
- The condition is the boolean expression that decides whether a YARA rule matches, combining patterns, file properties and modules.
- Detection Rule License (DRL)
- The Detection Rule License 1.1 lets anyone use and share detection rules if the author, a link and the licence are kept.
- False positive
- A false positive is a YARA match on a file that is not what the rule is meant to detect, typically legitimate software.
- filesize
- filesize is the YARA keyword holding the size in bytes of the scanned data, used as a cheap guard in conditions.
- fullword
- The fullword modifier requires a YARA string to be delimited by non-alphanumeric characters, so it is not matched inside longer words.
- Global rule
- A global YARA rule is a filter: if it evaluates to false for a file, no other rule in the same namespace can match that file.
- Goodware corpus
- A goodware corpus is a set of known-clean files used to test YARA rules for false positives before deploying them.
- Hex string
- A YARA hex string describes raw bytes in braces, with wildcards, nibble wildcards, jumps and alternatives for variable parts.
- IOC (indicator of compromise)
- An indicator of compromise is an observable artefact of an intrusion, such as a hash, domain, mutex or file pattern.
- Jump (hex)
- A jump in a YARA hex string, written [n-m], matches a run of n to m arbitrary bytes between two fixed parts of a pattern.
- Livehunt
- Livehunt is the VirusTotal feature that runs your YARA rules against newly submitted files and notifies you of matches.
- Meta section
- The meta section of a YARA rule stores documentation as key/value pairs: description, author, date, reference, hashes and more.
- Module
- YARA modules add parsed file formats and helper functions to conditions, for example pe, elf, dotnet, math and hash.
- Namespace
- A namespace groups YARA rules compiled together so that rule names only need to be unique within their namespace.
- nocase
- The nocase modifier makes a YARA text string or regex match regardless of letter case, at a cost in performance on short strings.
- Private rule
- A private YARA rule is evaluated and can be referenced by other rules, but is never reported as a match on its own.
- Regular expression
- YARA regular expressions are patterns between slashes with a Perl-like syntax, used when text or hex strings cannot express a match.
- Retrohunt
- Retrohunt is the VirusTotal feature that runs YARA rules over previously submitted files to find older samples.
- Rule tag
- Tags are labels declared after a YARA rule name; they do not affect matching and are used to filter and group results.
- Rule
- A YARA rule is a named block of optional metadata and patterns plus a mandatory boolean condition that decides whether data matches.
- String modifier
- String modifiers such as ascii, wide, nocase, fullword, xor, base64 and private change how a YARA pattern is searched and reported.
- Strings section
- The strings section declares the patterns a YARA rule searches for: text strings, hex strings and regular expressions, with modifiers.
- Text string
- A YARA text string is a quoted literal matched byte for byte, with escapes and optional modifiers such as wide, nocase or xor.
- wide
- The wide modifier matches a YARA string encoded as UTF-16LE, where each ASCII character is followed by a zero byte.
- Wildcard (hex)
- In a YARA hex string, ?? matches any byte and a single ? matches one nibble, letting a pattern ignore bytes that vary.
- xor modifier
- The xor modifier makes YARA also match a text string XORed with each single-byte key, optionally limited to a key range.
- YARA Forge
- YARA Forge collects, tests and scores public YARA rules and publishes them weekly as core, extended and full packages.
- YARA-X
- YARA-X is the Rust rewrite of YARA by VirusTotal: same rule language, stricter parsing, clearer errors and better performance.
- YARA
- YARA is an open-source pattern-matching engine and rule language used to identify and classify malware files and memory.