Glossary
False positive
A false positive is a YARA match on a file that is not what the rule is meant to detect, typically legitimate software.
A rule produces a false positive when it matches benign data — a system DLL, an installer, a document. Causes include generic strings, missing file-type guards and over-broad conditions. False positives erode trust in alerts and waste analyst time.
Measure them against a goodware corpus, exclude known clean markers with $fp* strings, and see testing and CI.