Lesson 3.14: Writing YARA rules
YARA is the pattern-matching language defenders use to describe a malware family by what its files contain, so a single rule catches variants that hash lists miss. A rule has strings to look for and a condition that combines them. A good rule is specific enough to avoid false positives on legitimate software and general enough to catch the next build. In the lab you test a colleague's draft rule, find the legitimate program it wrongly flags, tighten a better rule, and catch a new variant with a different C2 server that no hash or domain list knew about.
18 min
You will learn to
- Explain what YARA is for
- Read a rule's meta, strings and condition
- Scan directories with yara -r and -s
- Recognise and fix a false positive
- Write conditions that catch variants
Key terms
- YARA
- An open-source pattern-matching tool and rule language for identifying and classifying malware by content.
- strings section
- Named patterns: text ("..."), hex bytes ({ 4D 5A }) or regular expressions (/.../), with modifiers like nocase and wide.
- condition
- A Boolean expression deciding when the rule matches.
- False positive
- A detection on something harmless.
- False negative
- Missing something malicious.
← Absolute and relative paths · All lessons · Ports and sockets: which program gets the data →