yara

Scan file with rules

$ yara [rules.yar] [file]

$ yara -r [rules.yar] [directory]

$ yara [rules.yar] [pid]

$ yara -s [rules.yar] [file]

$ yara -m [rules.yar] [file]

$ yara [rules1.yar] [rules2.yar] [file]

$ yara -a [30] [rules.yar] [file]

$ yara -c [rules.yar] [file]

yara [-r] [-s] [-m] [-a timeout] [options] rules target

yara matches patterns against files or processes. It's the primary tool for malware classification and detection.
Rules define patterns using strings, regular expressions, and conditions. They describe characteristics of malware families or suspicious behavior.
String matching finds literal text, hex bytes, or regex patterns. Conditions combine matches with logic for precise detection.
Process scanning examines memory of running programs. This detects malware that may not be present on disk.
Metadata in rules provides context: author, description, severity, and references. This aids incident response.
External variables enable parameterized rules. Thresholds and settings can be adjusted without modifying rules.

-r

Recursive directory scan.

Show matching strings.

Show metadata.

Count matches only.

Timeout per file.

Negate (show non-matches).

Show tags.

Show namespace.

Disable warnings.

Fast matching mode.

Parallel threads.

Define external variable.

Rules require expertise to write well. False positives need tuning. Memory-resident malware harder to detect. Regular rule updates needed.

YARA was created by Victor M. Alvarez at VirusTotal around 2007. It became the standard for malware classification, used by antivirus vendors, incident responders, and researchers.

clamav(1), strings(1), file(1), ssdeep(1)