Skip to content

Glossary

Regular expression

YARA regular expressions are patterns between slashes with a Perl-like syntax, used when text or hex strings cannot express a match.

A regex pattern is written between slashes, optionally followed by the i and s flags: $r = /evil[0-9]{2}\.exe/i. It supports character classes, quantifiers, alternation, groups and anchors, and accepts the same modifiers as text strings (ascii, wide, nocase, fullword, private).

Regexes are the slowest pattern type. Include a literal of at least three characters and avoid a leading .*; see performance.