YARA Rules for Beginners: Examples and Cheat Sheet

YARA is a pattern-matching tool used to identify and classify malware. You describe what a file looks like in a rule, then scan files, folders or memory for matches. Analysts and threat intelligence teams share YARA rules the way they share indicators.

Install

• sudo apt install yara
• yara --version confirms it.

A First Rule

Save this line as lab.yar. It looks for the text "labtest" in a file:

• rule LabTest { strings: $a = "labtest" condition: $a }

A rule has a name, a strings section that lists patterns and a condition that says when it matches. Create a test file containing the word, then scan: yara lab.yar testfile.txt. YARA prints the rule name when the file matches.

Scan More

• yara -r lab.yar /path/to/folder scans a folder recursively.
• yara -s lab.yar testfile.txt also prints the strings that matched.
• Only scan files you own or have permission to examine. Treat real malware samples with care: use an isolated VM with no network.

Better Conditions

• 2 of them requires at least two of your strings, which cuts false positives.
• filesize < 2MB skips large files.
• uint16(0) == 0x5A4D checks for the "MZ" header at the start of a Windows executable.

Cheat Sheet

• yara rules.yar target scans a file.
• -r scans folders recursively.
• -s prints the matched strings.
• -m prints rule metadata.
• -c prints only the number of matches.
• 2 of them, any of them, all of them are common conditions.

We ran this rule and each option above on a test file before publishing.

What YARA Cannot Do

A rule that is too loose flags harmless files; one that is too tight misses a changed sample. Attackers change strings easily. Good rules combine several stable traits, and every rule needs testing against clean files. See malware analysis for beginners for how to find those traits, and what is threat hunting for how teams use rules.

Sources and Further Reading

• YARA documentation