YARA
The pattern-matching engine for malware researchers — write rules to identify and classify malware by textual or binary signatures.
YARA
YARA is the pattern-matching Swiss-army knife for malware researchers. It provides a rule language for describing malware families and other files of interest based on textual or binary patterns, then scans files, processes, or memory to identify matches. Each rule pairs a set of strings with a boolean condition, making detection logic expressive yet readable.
Key features
- Concise rule language combining string, hex, and regex patterns with boolean conditions
- Scans files, running processes, and memory dumps
- Modules (PE, ELF, Mach-O, hashes, and more) for structured, format-aware matching
- Fast C engine with official Python bindings (yara-python) and a CLI
- Portable across Windows, Linux, and macOS
Maintained by VirusTotal, YARA is a de facto standard for malware classification and threat hunting: analysts share rule sets to detect specific implants, packers, and campaign artifacts across large sample corpora. Because rules are plain text, they integrate cleanly into automated pipelines, sandboxes, and incident-response tooling. With BSD-3-Clause licensing and broad industry adoption, it remains a foundational building block for malware analysis and detection engineering.
Curated mirror of the open-source YARA (BSD-3-Clause). Get it from the source.
Compromise signals — malicious or tampered code (leaked secrets, backdoors, a dropped executable) — reduce the score, and known dependency CVEs carry a bounded penalty (they warrant review but never QUARANTINE — update the dependency to clear). Other dangerous-by-capability traits are risk surface, expected for some capabilities. Every finding is mapped to its OWASP control below.
Findings mapped to the OWASP Top 10 for LLM Applications (2025) and the OWASP Machine Learning Security Top 10. Expand any flagged control for the exact findings — compromise reduces the score; expected/risk-surface do not, except a known CVE, which carries a small bounded penalty (high/critical → Review).
The same gate an agent runs before installing (POST /api/v1/trust/yara-malware-pattern-matching/check). Click a policy:
Consume YARA programmatically. Authenticate with an API key or session — see Authorize an agent.
# Agents: CHECK BEFORE YOU INSTALL (no auth) — score, grade, level, capability manifest
curl https://ai-supply.store/api/v1/trust/yara-malware-pattern-matching
# Gate against your org policy (returns { pass, violations })
curl -X POST https://ai-supply.store/api/v1/trust/yara-malware-pattern-matching/check \
-H "Content-Type: application/json" \
-d '{"minGrade":"B","denyPermissions":["shell"],"denyUnknownEgress":true}'
# CLI
npx ai-supply add yara-malware-pattern-matching
# REST (install → download)
curl -X POST https://ai-supply.store/api/v1/listings/yara-malware-pattern-matching/install \
-H "Authorization: Bearer $AIM_KEY"
# MCP tool
install_listing({ "slug": "yara-malware-pattern-matching" })OpenAPI spec →Curated mirror — latest upstream source. See the repository for tagged releases.