YARA

Pattern-matching language for malware classification. Rules combine string and byte-pattern conditions with metadata. Used by VirusTotal, every major sandbox, and most threat-intel platforms. Rule sets like YARA-Forge, Florian Roth's signature-base and the YARA hub at YARA-Rules are common starting points.