YARA Documentation

YARA is a tool used to identify and classify malware samples (or any other data) based on textual or binary patterns. You create 'rules' that consist of a set of strings and a boolean expression (the condition) to determine matching logic.

rule silent_banker : banker
{
    meta:
        description = "This is just an example"
        threat_level = 3
        in_the_wild = true
    strings:
        $a = {6A 40 68 00 30 00 00 6A 14 8D 91}
        $b = {8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9}
        $c = "UVODFRYSIHLNWPEJXQZAKCBGMT"
    condition:
        $a or $b or $c
}

YARA is a tool used by malware researchers to identify and classify malware samples using textual or binary patterns. You can create 'rules' that consist of a set of strings and a boolean expression (condition) to determine logic.

Key features:

• Multi-platform: Runs on Windows, Linux, and Mac OS X.
• Interfaces: Available via Command Line Interface (CLI) or through Python via the yara-python extension.
• Rule Structure: Rules include meta (metadata), strings (patterns), and condition (logic).

Note: This project is currently in maintenance mode. For newer developments, refer to YARA-X.

YARA provides a module system to extend its core features. Modules allow you to define custom data structures and functions that can be used within YARA rules to express complex conditions.

Officially distributed modules include:

• PE: For analyzing Portable Executable files.
• ELF: For analyzing Executable and Linkable Format files.
• Cuckoo: For interacting with Cuckoo Sandbox results.
• Magic: For file type identification.
• Hash: For calculating file hashes.
• Math: For mathematical operations.
• Dotnet: For analyzing .NET metadata.
• Time: For time-based comparisons.
• Console: For console output/interaction.
• String: For advanced string manipulation.

You can use the vcpkg dependency manager to install YARA.

git clone https://github.com/microsoft/vcpkg.git
cd vcpkg
./bootstrap-vcpkg.sh
./vcpkg integrate install
vcpkg install yara

After writing your module source code, you must register it within the YARA build system to ensure it is compiled and linked.

1. Update module_list

Add your module to the libyara/modules/module_list file using the MODULE(<name>) syntax:

MODULE(demo)

2. Update Makefile.am

Modify libyara/modules/Makefile.am to include your source file in the MODULES list:

MODULES += libyara/modules/demo/demo.c

3. Rebuild YARA

Run the standard build sequence from the source tree root:

./bootstrap.sh
./configure
make
sudo make install

YARA supports creating rules based on structured data serialized via Protocol Buffers (protobufs). By importing a module generated from a protobuf definition, you can access the fields of the marshalled data structure directly within your YARA rule conditions.

To use this feature:

1. Define your data structure in a .proto file.
2. Use a protobuf compiler to generate the necessary code for your target language.
3. Import the resulting module in your YARA rule using the import "module_name" syntax.
4. Access the fields of the protobuf message using dot notation (e.g., module_name.field_name).

import "vt_employee"

rule virustotal_employee_under_25
{
  condition:
    vt_employee.age < 25 and
    vt_employee.email matches /*.@virustotal\.com/
}

To invoke YARA, you need a file containing rules and a target to scan (a file, a folder, or a process).

Basic Syntax: yara [OPTIONS] RULES_FILE TARGET

Important Security Note: Starting with YARA 3.9, you must explicitly use the -C flag if your RULES_FILE contains compiled rules. This prevents the accidental execution of malicious code from untrusted compiled rule files. If you are using source rules, do not use -C.

Multiple Rule Files: You can pass multiple source rule files. Note that this only works for source rules; when using compiled rules, only a single file is accepted.

Namespaces: By default, all rules share the same namespace. You can specify a namespace for an individual file using the namespace:FILE syntax. Files without a specified namespace will share the default namespace.

By default, YARA does not scan subdirectories. To scan a directory and all its contents recursively, use the -r or --recursive option. Note that -r follows symlinks.

yara /foo/bar/rules -r /foo

The Magic module identifies file types based on the output of the Unix file command. It provides two primary functions: type() and mime_type().

Important Constraints:

• This module is not supported on Windows.
• It is not built into YARA by default; you must ensure it is included during compilation.

Functions:

• type(): Returns a descriptive string representing the file type (e.g., "PDF document, version 1.5").
• mime_type(): Returns the MIME type string without the charset part (e.g., "application/pdf").

You can pass the content of a file as data to a specific YARA module using the -x <module>=<file> or --module-data=<module>=<file> option.

yara -x cuckoo=cuckoo_json_report /foo/bar/rules bazfile

To check how many times a string appears, use the string identifier prefixed with a # character.

• #a represents the number of occurrences of string $a.
• Starting with YARA 4.2.0, you can express counts within an integer range using the in operator.

Example: #a in (filesize-500..filesize) == 2 checks if string $a appears exactly twice in the last 500 bytes of the file.

rule CountExample
{
    strings:
        $a = "dummy1"
        $b = "dummy2"

    condition:
        #a == 6 and #b > 10
}