Skip to content

Glossary

Strings section

The strings section declares the patterns a YARA rule searches for: text strings, hex strings and regular expressions, with modifiers.

The strings: section declares patterns as $identifier = value [modifiers]. Values are text strings, hex strings or regular expressions. Each declared pattern must be used in the condition, directly or through a set such as them or ($a*).

YARA searches for all patterns in one pass before evaluating conditions. See the strings guide.