YARA
Definition
Pattern-matching language for malware classification. Rules combine string and byte-pattern conditions with metadata. Used by VirusTotal, every major sandbox, and most threat-intel platforms. Rule sets like YARA-Forge, Florian Roth's signature-base and the YARA hub at YARA-Rules are common starting points.
- Purpose
- Pattern-matching language for malware classification
- Rule structure
- String and byte-pattern conditions plus metadata
- Used by
- VirusTotal, sandboxes, threat-intel platforms
- Common rule sets
- YARA-Forge, signature-base, YARA-Rules
Common questions
What can a YARA rule detect that a simple hash match cannot?+
A hash match only flags an exact known file, while a YARA rule matches on strings, byte patterns and structural conditions within a file, so it can catch variants of known malware families, packed or slightly modified samples, and files sharing code with a known threat despite not being byte-identical.
Why do investigators combine multiple YARA rule sets rather than writing their own from scratch?+
Community-maintained sets such as YARA-Forge or signature-base aggregate rules contributed and tested by many researchers against large malware collections, giving broader and more current coverage than one analyst could realistically author and validate alone, though custom rules are still written for case-specific indicators.
Related terms
- Entropy (Shannon)
- Per-byte information density of a file or section. Plain code sits around 5.5; packed or encrypted sections exceed 7.0. A PE with...
- ImpHash
- Mandiant's hash of the ordered list of imported functions in a PE file's import table. Survives recompilation that does not change imports;...
- IoC (Indicator of Compromise)
- Observable artefact linked to malicious activity. File hashes (MD5, SHA-256, ImpHash, ssdeep, TLSH), IPs, domains, URLs, registry keys, mutex names, named pipes,...
- PE (Portable Executable) Header
- The Windows executable file format. Starts with an MZ DOS stub, points to a PE signature, then a COFF file header, an...
- Volatility 3
- Open-source memory forensics framework, Python 3 rewrite of Volatility 2. Symbol-based (PDB symbols on Windows) instead of profile-based, supports modern Windows 10/11...