Skip to content
yararules.org
Menu

Glossary

nocase

The nocase modifier makes a YARA text string or regex match regardless of letter case, at a cost in performance on short strings.

nocase makes a text string or regex case-insensitive: "invoke-expression" nocase also matches Invoke-Expression. Internally YARA must consider case variants, so on short strings it produces many weak atoms.

Use it on strings of six characters or more. It cannot be combined with xor or base64.