Skip to content

Glossary

YARA

YARA is an open-source pattern-matching engine and rule language used to identify and classify malware files and memory.

YARA is an open-source tool, created at VirusTotal, that matches files, memory or byte streams against rules. A rule combines patterns (text, hex bytes, regular expressions) with a boolean condition. Malware analysts use it to classify samples by family, hunt for tools across an estate and triage evidence during incidents.

The classic implementation, YARA 4.x, is written in C. Its successor YARA-X keeps the same rule language. Read what is YARA for an introduction.