| YARA | |
|---|---|
| Designed by | Victor Alvarez |
| First appeared | 2013 |
| Stable release | |
| Filename extensions | .yara |
| Website | virustotal |
YARA is a tool primarily used in malware research and detection.
Contents
It provides a rule-based approach to create descriptions of malware families based on regular expression, textual or binary patterns. A description is essentially a YARA rule name, where these rules consist of sets of strings and a Boolean expression. [2]
Analysts write YARA rules to capture the DNA of malware families, persistent elements like code fragments, configuration strings, and structural patterns expressed as text, hex sequences, or regex with Boolean logic. This signature-based detection survives file mutations that defeat hash matching, enabling identification of variants and related samples across large datasets [3] .
