What is YARA? Pattern matching for malware hunters

YARA is an open-source pattern-matching engine built for malware research. You describe what a family of files looks like — some strings, a few byte sequences, a header check — and YARA tells you which files, memory dumps or data streams match that description. It was created by Victor Alvarez at VirusTotal, and its rule language has become the common way for analysts to share detection logic for files.

This guide explains how a rule works, where YARA is used, and how it relates to the newer YARA-X engine that powers the tools on this site.

How a YARA rule matches

A rule has two important parts: patterns (called strings) and a condition. YARA first searches the data for every pattern, then evaluates the condition, which can combine pattern matches with properties of the file such as its size or the bytes at a given offset.

rule SUSP_Example_Download_Cradle
{
    meta:
        description = "PowerShell download cradle inside a Windows executable"
        author = "yararules.org"
        date = "2026-09-29"
    strings:
        $ps = "powershell" ascii wide nocase
        $dl = "DownloadString(" ascii wide
    condition:
        uint16(0) == 0x5A4D and filesize < 5MB and $ps and $dl
}

Read it from the bottom up: the file must start with the MZ header of a Windows executable, be smaller than 5 MB, and contain both strings. The meta section documents the rule; it never influences matching. The syntax guide walks through each section in detail.

YARA does not execute or unpack anything. It looks at bytes as they are. That is both its strength — it is fast, predictable and safe to run on hostile files — and its main limit: a packed or encrypted sample only exposes the bytes of its packer.

What YARA is used for

• Malware classification. Labelling samples by family ("this is Emotet", "this is a Cobalt Strike beacon") in sandboxes and malware repositories.
• Threat hunting. Sweeping file shares, endpoints or backups for a tool or implant seen in another intrusion.
• Incident response triage. Scanning a disk image, a triage collection or a memory dump for known tooling. See writing rules for incident response.
• Memory analysis. Many implants only exist decrypted in memory; YARA can scan process memory where file scanning fails.
• Content inspection. Email gateways, web proxies and file-upload pipelines use YARA to flag documents and archives.
• Threat-intelligence platforms. Services such as VirusTotal run user rules continuously against new submissions (see YARA on VirusTotal).

YARA compared with other detection languages

The three are complementary. A single intrusion might be covered by a Sigma rule for the suspicious command line, a Suricata rule for the command-and-control traffic, and a YARA rule for the dropped payload.

YARA and YARA-X

The original YARA (version 4.x) is written in C and is still maintained. YARA-X is its successor, rewritten in Rust by VirusTotal and already used in production there. It keeps the same rule language, so most existing rules compile without changes, but it is stricter about a few ambiguous constructs and gives much clearer error messages with line and column numbers.

Every tool on this site runs YARA-X compiled to WebAssembly inside your browser. When you use the online scanner or the rule editor, your files are read locally and never uploaded. The YARA-X vs YARA guide lists the differences that matter when you migrate rules.

Limits to keep in mind

• False positives. A rule is only as specific as its patterns. Short or generic strings match legitimate software; testing against a goodware corpus is essential.
• Packing and obfuscation. Encrypted payloads hide their strings. Rules then target the loader, the decryption routine or run against memory instead.
• Performance. Patterns that give YARA no good atom to search for can slow every scan. The performance guide and the linter help you avoid them.
• Maintenance. Malware changes. Good rules carry metadata (author, date, reference) so the next analyst knows what they were meant to catch.

Where to go next

1. Learn the structure of a rule in YARA syntax.
2. Choose the right pattern type with the strings guide.
3. Browse real-world examples in the rule library — thousands of public rules, each with its author and licence.
4. Write your first rule in the online editor and test it against a sample file without uploading anything.