Skip to content
yararules.org
Menu

Glossary

Global rule

A global YARA rule is a filter: if it evaluates to false for a file, no other rule in the same namespace can match that file.

global rule Size_Limit { condition: filesize < 10MB } applies its condition to every other rule of its namespace. It is a blunt tool: a mistake in a global rule silently disables everything else. Most rule sets prefer explicit guards or private rules referenced where needed.