Learn YARA

Practical, tested guides — every complete rule example compiles with YARA-X.

1. 01What is YARA? Pattern matching for malware huntersWhat YARA is, how a YARA rule matches bytes in files and memory, where it is used in detection and incident response, and how YARA-X fits in.
2. 02YARA syntax: anatomy of a ruleThe structure of a YARA rule: identifiers, tags, meta, strings and condition sections, imports, comments, private and global rules, and common syntax errors.
3. 03YARA strings: text, hex and regex patternsHow to write YARA strings: text strings and escapes, modifiers like nocase, wide, xor and base64, hex strings with wildcards and jumps, and regular expressions.
4. 04YARA conditions: counts, offsets, loops and setsWrite YARA conditions: boolean logic, string counts and offsets, filesize and magic-byte checks, any/all/N of sets, for loops, YARA-X with and rule references.
5. 05YARA modules: pe, elf, dotnet, math, hash and moreUse YARA modules to query parsed file formats: pe imports and sections, elf, macho, dotnet, lnk, math entropy, hash, console and string, with YARA-X notes.
6. 06YARA performance: atoms, fast strings and conditionsWhy some YARA rules are slow and how to fix them: how atoms and the prefilter work, good and bad strings, hex with fixed bytes, regex anchors and cheap guards.
7. 07Testing YARA rules: samples, goodware and CIHow to test YARA rules before deploying them: positive samples, a goodware corpus for false positives, yr check, unit tests and a GitHub Actions CI pipeline.
8. 08YARA-X vs YARA: differences and migrationYARA-X, the Rust rewrite of YARA by VirusTotal: compatibility, stricter parsing, new features, CLI differences, a migration checklist and YARA-X in the browser.
9. 09Writing YARA rules for incident responseUse YARA during incident response: scoping, writing a rule from a sample, choosing unique strings, confidence scores, hunting across hosts and memory, and sharing.
10. 10YARA rule naming and style conventionsConventions used in public YARA rule sets: rule name prefixes, meta fields, string naming ($x, $s, $fp), formatting with yr fmt, comments and versioning.
11. 11Public YARA rule sets, YARA Forge and licencesThe public YARA rule ecosystem: YARA Forge packages, major repositories like Signature Base and Malpedia, the licences you will meet and what they allow.
12. 12YARA on VirusTotal: Livehunt and RetrohuntHow YARA is used on VirusTotal: Livehunt for new submissions, Retrohunt over past files, the vt module, and how to test rules locally before running them there.
13. 13YARA cheat sheet: syntax, modifiers, conditionsA one-page YARA and YARA-X reference: rule skeleton, string types and modifiers, hex syntax, condition operators, quantifiers, loops, magic bytes and CLI.