Skip to content

Glossary

Rule

A YARA rule is a named block of optional metadata and patterns plus a mandatory boolean condition that decides whether data matches.

A rule starts with the rule keyword and an identifier, optionally followed by tags, then a body in braces with up to three sections: meta, strings and condition. Only the condition is mandatory. Rules can be marked private or global and can reference each other.

See YARA syntax for the full structure.