|
Name |
|
Date |
Size |
#Lines |
LOC |
| .. | | 03-May-2022 | - |
| .github/workflows/ | H | 24-May-2021 | - | 26 | 23 |
| bazel/ | H | 24-May-2021 | - | 677 | 630 |
| cli/ | H | 24-May-2021 | - | 2,682 | 1,886 |
| dist/ | H | 24-May-2021 | - | 122 | 85 |
| docs/ | H | 24-May-2021 | - | 7,469 | 4,898 |
| extra/codemirror/ | H | 03-May-2022 | - | | |
| libyara/ | H | 03-May-2022 | - | 64,699 | 45,115 |
| m4/ | H | 24-May-2021 | - | 365 | 321 |
| sandbox/ | H | 24-May-2021 | - | 1,242 | 825 |
| tests/ | H | 24-May-2021 | - | 12,322 | 9,786 |
| windows/ | H | 24-May-2021 | - | 1,594 | 1,586 |
| .bazelrc | H A D | 24-May-2021 | 75 | 3 | 2 |
| .clang-format | H A D | 24-May-2021 | 4.3 KiB | 159 | 158 |
| .gitignore | H A D | 24-May-2021 | 1.1 KiB | 107 | 98 |
| .travis.yml | H A D | 24-May-2021 | 4.6 KiB | 127 | 113 |
| AUTHORS | H A D | 24-May-2021 | 563 | 17 | 13 |
| BUILD.bazel | H A D | 24-May-2021 | 4.2 KiB | 138 | 128 |
| CONTRIBUTORS | H A D | 24-May-2021 | 1.6 KiB | 40 | 36 |
| COPYING | H A D | 24-May-2021 | 1.5 KiB | 27 | 21 |
| Makefile.am | H A D | 03-May-2022 | 3.3 KiB | 140 | 110 |
| README.md | H A D | 24-May-2021 | 6 KiB | 136 | 119 |
| WORKSPACE.bazel | H A D | 24-May-2021 | 1.9 KiB | 52 | 42 |
| appveyor.yml | H A D | 24-May-2021 | 2.9 KiB | 110 | 89 |
| bootstrap.sh | H A D | 24-May-2021 | 39 | 3 | 1 |
| build.sh | H A D | 24-May-2021 | 41 | 4 | 3 |
| configure.ac | H A D | 24-May-2021 | 11.8 KiB | 348 | 304 |
| sample.file | H A D | 24-May-2021 | 6 | 2 | 1 |
| sample.rules | H A D | 24-May-2021 | 178 | 13 | 9 |
| yara.man | H A D | 24-May-2021 | 3.5 KiB | 161 | 159 |
| yarac.man | H A D | 24-May-2021 | 1.6 KiB | 54 | 52 |
README.md
1[![Join the chat at https://gitter.im/VirusTotal/yara](https://badges.gitter.im/Join%20Chat.svg)](https://gitter.im/VirusTotal/yara?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
2[![Travis build status](https://travis-ci.com/VirusTotal/yara.svg)](https://travis-ci.com/VirusTotal/yara)
3[![AppVeyor build status](https://ci.appveyor.com/api/projects/status/7glqg19w4oolm7pr?svg=true)](https://ci.appveyor.com/project/plusvic/yara)
4[![Coverity status](https://scan.coverity.com/projects/9057/badge.svg?flat=1)](https://scan.coverity.com/projects/plusvic-yara)
5
6
7
8## YARA in a nutshell
9
10YARA is a tool aimed at (but not limited to) helping malware researchers to
11identify and classify malware samples. With YARA you can create descriptions of
12malware families (or whatever you want to describe) based on textual or binary
13patterns. Each description, a.k.a. rule, consists of a set of strings and a
14boolean expression which determine its logic. Let's see an example:
15
16```yara
17rule silent_banker : banker
18{
19 meta:
20 description = "This is just an example"
21 threat_level = 3
22 in_the_wild = true
23
24 strings:
25 $a = {6A 40 68 00 30 00 00 6A 14 8D 91}
26 $b = {8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9}
27 $c = "UVODFRYSIHLNWPEJXQZAKCBGMT"
28
29 condition:
30 $a or $b or $c
31}
32```
33
34The above rule is telling YARA that any file containing one of the three strings
35must be reported as *silent_banker*. This is just a simple example, more
36complex and powerful rules can be created by using wild-cards, case-insensitive
37strings, regular expressions, special operators and many other features that
38you'll find explained in [YARA's documentation](https://yara.readthedocs.org/).
39
40YARA is multi-platform, running on Windows, Linux and Mac OS X, and can be used
41through its command-line interface or from your own Python scripts with the
42yara-python extension.
43
44## Additional resources
45
46Do you use GitHub for storing your YARA rules? [YARA-CI](https://yara-ci.cloud.virustotal.com)
47may be a useful addition to your toolbelt. This is GitHub application that provides
48continuous testing for your rules, helping you to identify common mistakes and
49false positives.
50
51If you plan to use YARA to scan compressed files (.zip, .tar, etc) you should
52take a look at [yextend](https://github.com/BayshoreNetworks/yextend), a very
53helpful extension to YARA developed and open-sourced by Bayshore Networks.
54
55Additionally, the guys from [InQuest](https://inquest.net/) have curated an
56awesome list of [YARA-related stuff](https://github.com/InQuest/awesome-yara).
57
58## Who's using YARA
59
60* [ActiveCanopy](https://activecanopy.com/)
61* [Adlice](http://www.adlice.com/)
62* [AlienVault](https://otx.alienvault.com/)
63* [Avast](https://www.avast.com/)
64* [BAE Systems](http://www.baesystems.com/home?r=ai)
65* [Bayshore Networks, Inc.](http://www.bayshorenetworks.com)
66* [BinaryAlert](https://github.com/airbnb/binaryalert)
67* [Blue Coat](http://www.bluecoat.com/products/malware-analysis-appliance)
68* [Blueliv](http://www.blueliv.com)
69* [Claroty](https://claroty.com/continuous-threat-detection)
70* [Cofense](https://cofense.com)
71* [Conix](http://www.conix.fr)
72* [CounterCraft](https://www.countercraft.eu)
73* [CrowdStrike FMS](https://github.com/CrowdStrike/CrowdFMS)
74* [Cuckoo Sandbox](https://github.com/cuckoosandbox/cuckoo)
75* [Cyber Triage](http://www.cybertriage.com)
76* [Cybereason](https://www.cybereason.com)
77* [Digita Security](https://digitasecurity.com/product/uxprotect)
78* [Dragos Platform](https://dragos.com/platform/)
79* [Dtex Systems](https://dtexsystems.com)
80* [ESET](https://www.eset.com)
81* [ESTsecurity](https://www.estsecurity.com)
82* [Fidelis XPS](http://www.fidelissecurity.com/network-security-appliance/Fidelis-XPS)
83* [FireEye, Inc.](http://www.fireeye.com)
84* [Forcepoint](https://www.forcepoint.com)
85* [Fox-IT](https://www.fox-it.com)
86* [FSF](https://github.com/EmersonElectricCo/fsf)
87* [Guidance Software](http://www.guidancesoftware.com/endpointsecurity)
88* [Heroku](https://heroku.com)
89* [Hornetsecurity](https://www.hornetsecurity.com/en/)
90* [InQuest](http://www.inquest.net/)
91* [JASK](http://jask.io)
92* [Joe Security](https://www.joesecurity.org)
93* [jsunpack-n](http://jsunpack.jeek.org/)
94* [Kaspersky Lab](http://www.kaspersky.com)
95* [KnowBe4](https://www.knowbe4.com)
96* [Koodous](https://koodous.com/)
97* [Laika BOSS](https://github.com/lmco/laikaboss)
98* [Lastline, Inc.](http://www.lastline.com)
99* [LimaCharlie](https://limacharlie.io/)
100* [McAfee Advanced Threat Defense](http://mcafee.com/atd)
101* [Metaflows](http://www.metaflows.com)
102* [NBS System](https://www.nbs-system.com/)
103* [Nextron Systems](https://www.nextron-systems.com)
104* [Nozomi Networks](http://www.nozominetworks.com)
105* [osquery](http://www.osquery.io)
106* [Payload Security](https://www.payload-security.com)
107* [PhishMe](http://phishme.com/)
108* [Picus Security](http://www.picussecurity.com/)
109* [Radare2](http://rada.re)
110* [Raytheon Cyber Products, Inc.](http://www.raytheoncyber.com/capabilities/products/sureview-threatprotection/)
111* [RedSocks Security](https://redsocks.eu/)
112* [ReversingLabs](http://reversinglabs.com)
113* [root9B](https://www.root9b.com)
114* [RSA ECAT](http://www.emc.com/security/rsa-ecat.htm)
115* [Scanii](https://scanii.com)
116* [SecondWrite](https://www.secondwrite.com)
117* [SonicWall](https://www.sonicwall.com/)
118* [SpamStopsHere](https://www.spamstopshere.com)
119* [stoQ](http://stoq.punchcyber.com)
120* [Symantec](http://www.symantec.com)
121* [Tanium](http://www.tanium.com/)
122* [Tenable Network Security](https://www.tenable.com/)
123* [The DigiTrust Group](http://www.digitrustgroup.com/)
124* [ThreatConnect](https://www.threatconnect.com/)
125* [ThreatStream, Inc.](http://threatstream.com)
126* [Thug](https://github.com/buffer/thug)
127* [TouchWeb](https://www.touchweb.fr)
128* [Trend Micro](http://www.trendmicro.com)
129* [VirusTotal Intelligence](https://www.virustotal.com/intelligence/)
130* [VMRay](https://www.vmray.com/)
131* [We Watch Your Website](http://www.wewatchyourwebsite.com/)
132* [x64dbg](http://x64dbg.com)
133* [YALIH](https://github.com/Masood-M/YALIH)
134
135Are you using it? Want to see your site listed here?
136