Skip to content
yararules.org
Menu

Glossary

Text string

A YARA text string is a quoted literal matched byte for byte, with escapes and optional modifiers such as wide, nocase or xor.

A text string is written in double quotes: $a = "cmd.exe /c". It supports the escapes \", \\, \t, \n, \r and \xNN. By default it matches ASCII bytes; string modifiers such as wide, nocase, fullword, xor and base64 change how it is searched.

Aim for strings of at least four, ideally eight or more, distinctive characters.