security enabled verified low v1.0.0

yara

Pattern matching swiss knife for malware researchers to identify and classify malware samples based on textual or binary patterns.

📋 Live Preview 
yara {flags} {rule-file} {target}
📎 flags 📎 rule-file 📎 target 
yara {flags} {rule-file} {target}

Sandbox: execFile · Timeout: 300s

Capabilities

malware.analyze
malware.classify
malware.detect
forensics.scan
binary.pattern.match

Parameters

Name Type Required Default Description Aliases
rule-file string Yes - YARA rule file or directory -
target string Yes - File, directory, or PID to scan -
flag-s boolean No - Print strings that matched -s, --print-strings
flag-m boolean No - Print meta data -m, --print-meta
flag-n boolean No - Print only rule names -n, --negate
flag-g integer No - Number of tags to print -g, --tag
flag-r boolean No - Recursive directory scan -r, --recursive
flag-c boolean No - Print count of matches -c, --count
flag-p integer No - Number of parallel threads -p, --threads

Artifacts

TypeDescriptionMIMESchemaTrust
report.txtYARA scan resultstext/plain-verified
report.jsonYARA scan results in JSONapplication/json-verified

Contract

Inputs

file.path

File or directory to scan

security.rule.file

YARA rule file to apply

Outputs

report.txt

Scan results with matched rules

report.json

Scan results in JSON format

Side effects: filesystem_write

Workflow Edges

Produces

report.txtreport.json

Consumes

file.pathsecurity.rule.file

Resource Profile

ResourceValue
CPUmedium
Memory256 MB
Networknone
Disk I/Omedium

Examples

Scan a file with a YARA rule

yara rule.yara suspicious.exe

Scan a directory recursively

yara -r malware_rules/ /samples/

Print matched strings

yara -s myrule.yar sample.bin

Scan with multiple rule files

yara -r rules/ -c sample.exe

Scan a running process by PID

yara rule.yara <PID>

Documentation

YARA — Malware Pattern Matching

YARA is a pattern matching tool designed for malware researchers to create descriptions of malware families based on textual or binary patterns. Rules consist of strings definitions and boolean expressions that determine the logic.

Rule Structure

rule ExampleRule {
    meta:
        description = "Example YARA rule"
        author = "Researcher"
    strings:
        $text_string = "malicious_string"
        $hex_string = { 4D 5A 90 00 }
        $byte_string = "This program" nocase
    condition:
        $text_string or $hex_string
}

Common Commands

# Scan files with rules
yara -s rules.yara /path/to/malware.exe

# Recursive directory scan
yara -r /path/to/rules/ /samples/directory/

# Scan with metadata output
yara -m rules.yara suspicious.bin

Related Tools

binwalkvolatilityradare2ghidra

References