YARA
YARA is a pattern-matching tool that identifies and classifies files, often malware, using rules made of strings and conditions.
Legal & ethical use. Use this tool only on systems, networks and data that you own or have explicit written permission to test. Unauthorised access or scanning can break computer-misuse laws (for example Pakistan's Prevention of Electronic Crimes Act, 2016, and equivalents elsewhere). Practise in your own lab or in authorised environments such as CTFs.
What it is used for
- Write a rule that detects a specific marker in samples from a lab
- Scan a folder for files matching known indicators
Key features
- Text and hex string patterns
- Boolean conditions and modules
- Fast file and process scanning
Installation
Install from your distribution (`sudo apt install yara`) or build from source.
Beginner usage guide
Write a small rule, test it on benign sample files you create, then tighten the conditions to avoid false positives.
Example commands
Run these only against your own lab or authorised targets. Placeholder addresses such as 192.0.2.x are documentation ranges.
Scan a directory with a rule file
yara -r my_rules.yar ./samples-r recurses into the directory; matching rule names are printed with each file.
References
Source verification
Last reviewed: 2026-10-27
Links checked over HTTP: 2026-10-27 07:51 UTC — official: 200, docs: 200, repo: 200
Commands were written from the official documentation and have not been executed on this site; test them in your lab.