YARA

What YARA Is and How Pattern-Matching Malware Detection Works

• YARA (Yet Another Recursive Acronym) is a tool for identifying and classifying malware samples.
• It works by matching rules — sets of strings, hex byte sequences, and boolean conditions — against files, processes, and memory.
• YARA was created by Victor Alvarez of VirusTotal and is the standard format for expressing malware detection logic in the security industry.
• Every major threat intelligence platform, malware analysis sandbox, and EDR uses YARA rules under the hood.

YARA Rule Structure

Every YARA rule has three main sections: meta, strings, and condition.

rule Example_Rule
{
    meta:
        description = "Detects a specific malware family"
        author = "SOC Analyst"
        date = "2026-05-23"
        mitre_technique = "T1059.001"
        severity = "high"

    strings:
        $string1 = "malicious_string_here"
        $hex1 = { 90 90 90 90 E8 00 00 00 00 }
        $regex1 = /https?:\/\/evil[0-9]+\.com/

    condition:
        $string1 or $hex1 or $regex1
}

Rule Components Explained

Writing Practical YARA Rules

String-Based Rules — The Most Common

Single string match — simple:

rule Detect_Mimikatz_String
{
    strings:
        $mimikatz = "mimikatz"
    condition:
        $mimikatz
}

Multi-string match — better (reduces FPs):

rule Detect_Mimikatz_Comprehensive
{
    strings:
        $s1 = "mimikatz" nocase
        $s2 = "sekurlsa" nocase
        $s3 = "lsadump" nocase
        $s4 = "kerberos" nocase
        $s5 = "::" nocase   (mimikatz uses :: as command separator)
    condition:
        2 of them
}

This rule matches any file that contains at least 2 of the specified strings. The nocase modifier makes matching case-insensitive. The 2 of them condition prevents FPs from a single false match (e.g., a legitimate tool with “mimikatz” in a comment). Combine with Sigma rules for detection logic that triggers YARA scans.

Hex Pattern Rules — For Binary Data

rule Detect_Shellcode_NOP_Sled
{
    strings:
        $nop_sled = { 90 90 90 90 90 }
    condition:
        $nop_sled
}

Hex fields explained:

• { 90 90 90 90 90 } — five consecutive NOP (0x90) instructions
• Wildcards: { 90 ?? E8 ?? 00 00 } — ?? matches any byte

PE Header Rules — For Windows Executables

rule Detect_Suspicious_PE_Section
{
    strings:
        $section_name = ".text" fullword  (normal code section name)
    condition:
        pe.number_of_sections > 10  (normal PE has < 10 sections)
}

PE-specific keywords:

Example — detect UPX-packed files:

rule Detect_UPX_Packed
{
    strings:
        $upx1 = "UPX!"  (UPX signature)
        $upx2 = "UPX0"  (UPX section name)
    condition:
        $upx1 or $upx2
}

Regex Rules — For Pattern Variation

rule Detect_PowerShell_EncodedCommand
{
    strings:
        $re1 = /-EncodedCommand\s+[A-Za-z0-9+\/=]{20,}/
    condition:
        $re1 and pe.is_dll() == false (likely malware, not a script)
}

When to use regex: The string has variable content (e.g., a base64 payload of any length) or a structured pattern (URL, IP address, email). Regex is slower than plain string matching — use sparingly.

Advanced Conditions

Hunting Workflow — Using YARA in the SOC

Step 1 — Define the Hypothesis

Before writing any rule, answer: What am I looking for, and where? Integrate with MISP to auto-generate YARA rules from threat intelligence events.

Step 2 — Write the Rule

Use the rule structure above. Test on known samples first (VirusTotal, Joe Sandbox samples).

Step 3 — Scan (use REMnux for a pre-configured YARA environment)

# Scan a single file
yara my_rule.yar suspicious.exe

# Scan a directory recursively
yara -r my_rule.yar C:\Users\Public\

# Scan a running process by PID
yara -p 1234 my_rule.yar

# Scan all running processes
yara -p 1-9999 my_rule.yar

Step 4 — Validate and Tune

Integrating YARA into Detection Pipelines

Option 1 — YARA + EDR

Most modern EDRs support YARA scanning. Schedule scans of high-value hosts (Domain Controllers, file servers, admin workstations).

Option 2 — YARA + SIEM

# Cron job: scan new files in a monitored directory every hour
yara -r -m ~/rules/ /share/monitored/ | logger -t yara_scan

Option 3 — YARA + VirusTotal

Submit all detected files to VirusTotal for cross-reference. If VirusTotal agrees (2+ engines detect), escalate to incident.

Related

• Indicators: IoC, IoA, and TTP — covers the indicators: ioc, ioa, and ttp concepts
• MITRE ATT&CK for Triage — covers the mitre att&ck for triage concepts
• Living-off-the-Land Binaries — how living-off-the-land binaries attacks work and how to detect them
• Azure Sentinel — detection and response for T1654 techniques
• BloodHound — detection and response for T1087 techniques

Sources

• YARA Documentation
• YARA GitHub
• VirusTotal YARA
• SANS — Writing Effective YARA Rules