Skip to content
yararules.org
Menu

YARA rule naming and style conventions

Conventions used in public YARA rule sets: rule name prefixes, meta fields, string naming ($x, $s, $fp), formatting with yr fmt, comments and versioning.

Published 3 min read

Style does not change what a rule matches, but it decides whether the next analyst can understand, trust and maintain it. The conventions below are the ones you will see in large public rule sets such as Signature Base or the YARA Forge packages; adopting them makes your rules familiar to everyone.

Rule names

A common pattern is PREFIX_Family_Detail_Date:

PrefixMeaningExample
MAL_MalwareMAL_Emotet_Loader_Mar24
APT_Threat-actor toolingAPT_UNC0000_Backdoor_Config
HKTL_Hack tool / offensive frameworkHKTL_CobaltStrike_Beacon_Strings
SUSP_Suspicious trait, not malicious by itselfSUSP_PE_Overlay_Base64_Script
EXPL_Exploit or exploit documentEXPL_CVE_2023_23397_Outlook
WEBSHELL_Web shellWEBSHELL_PHP_Generic_Eval
PUA_Potentially unwanted applicationPUA_Miner_XMRig_Config

Some sets add a platform (MAL_Win_, MAL_Linux_) or a technique. YARA Forge additionally prefixes every rule with its source (SIGNATURE_BASE_…), which is why rule pages in this library show both names.

Meta fields

FieldPurpose
descriptionOne sentence: what the rule detects
authorWho wrote it (kept visible when matches are reported under DRL 1.1)
referenceReport, blog post or case that motivated the rule
date / modifiedCreation and last change, YYYY-MM-DD
idStable UUID, survives renames
hashSample hashes used to build or test the rule (repeat the key)
score0–100 confidence that a match is malicious
licenseLicence of the rule, when it differs from the repository's
rule MAL_Example_Conventions_Sep26
{
    meta:
        description = "Example loader showing the usual meta fields"
        author = "yararules.org"
        reference = "https://yararules.org/en/learn/style-conventions"
        date = "2026-09-29"
        modified = "2026-09-29"
        id = "5b0f7a58-1f35-4c1c-9d3e-6b2f4b1b8a10"
        hash = "0000000000000000000000000000000000000000000000000000000000000000"
        score = 75
        license = "DRL-1.1"
    strings:
        $x1 = "ExampleLoader_v3_config" ascii
        $s1 = "Stage2Url" wide
        $s2 = "InjectInto" ascii
        $fp1 = "Copyright (c) Example Software GmbH" wide
    condition:
        uint16(0) == 0x5A4D and filesize < 2MB and
        not 1 of ($fp*) and
        (1 of ($x*) or all of ($s*))
}

String naming

  • $x* — highly specific strings, each enough on its own.
  • $s* — supporting strings that only count in combination.
  • $a*, $op* — groups by topic, e.g. $op* for opcode sequences.
  • $fp* — false-positive exclusions, used with not.

Sets then read naturally: 1 of ($x*) or 3 of ($s*).

Formatting

Consistent layout makes diffs readable. YARA-X's yr fmt rewrites rules in a canonical format. The linter on this site has a conservative formatter that only changes whitespace: it re-indents sections, aligns = signs and leaves rules with comments untouched.

  • Four spaces (or one tab) for section keywords, eight for their content.
  • One pattern per line; long hex strings may wrap.
  • A blank line between rules.

Comments

Use comments for reasoning that doesn't belong in meta — why a byte is wildcarded, which build a pattern came from — and keep them short. Anything a consumer should see in scan results goes in meta instead.

Versioning and change control

  • Never reuse a rule name for different logic; create a new rule and retire the old one.
  • Keep id stable across renames and update modified on every logic change.
  • Record false positives and their fixes (see testing and CI).
  • State a licence: without one, others cannot legally reuse your rule (see public rule sets).

Browse rules from different sources in the library to see these conventions in practice, and check your own with the linter.

FAQ

What do prefixes like MAL_ or HKTL_ mean in YARA rule names?
They classify the rule: MAL_ for malware, HKTL_ for hack tools, SUSP_ for suspicious traits, APT_ for threat-actor tooling, EXPL_ for exploits, WEBSHELL_ for web shells and PUA_ for potentially unwanted applications.
Which meta fields should every YARA rule have?
At least description, author, date and reference. Many rule sets add id, modified, score, hash and license.
Is there an official YARA formatter?
YARA-X ships yr fmt, which rewrites rules in a canonical layout. The linter on this site also has a conservative formatter that only changes whitespace.