YARA

YARA is a tool primarily used in malware research and detection.

It provides a rule-based approach to create descriptions of malware families based on regular expression, textual or binary patterns. A description is essentially a YARA rule name, where these rules consist of sets of strings and a Boolean expression.[1]

Analysts write YARA rules to capture the DNA of malware families, persistent elements like code fragments, configuration strings, and structural patterns expressed as text, hex sequences, or regex with Boolean logic. This signature-based detection survives file mutations that defeat hash matching, enabling identification of variants and related samples across large datasets[2].

## Contents

* 1 History
* 2 Design
* 3 See also
* 4 References
* 5 External links

## History

YARA was originally developed by Victor Alvarez of VirusTotal and released on GitHub in 2013.[3] The name is an abbreviation of YARA: Another Recursive Acronym or Yet Another Ridiculous Acronym.[4] In 2024, Alvarez announced that YARA would be superseded by a rewrite called YARA-X, written in Rust.[5] A first stable version of YARA-X was released in June 2025, marking the passage of the original YARA into maintenance mode.[6]

## Design

YARA by default comes with modules to process PE, ELF analysis, as well as support for the open-source Cuckoo sandbox.

## See also

* Sigma
* Snort

## References

1. ↑ "Welcome to YARA's documentation!". https://yara.readthedocs.io/en/latest/index.html.
2. ↑ "What Are YARA Rules? A Complete 2025 Guide with Examples" (in en-us). https://www.picussecurity.com/resource/glossary/what-is-a-yara-rule.
3. ↑ "Release v1.7.1". https://github.com/VirusTotal/yara/releases/tag/v1.7.1.
4. ↑ Victor M. Alvarez [@plusvic] (22 September 2016). "@milliped @yararules YARA is an acronym for: YARA: Another Recursive Acronym, or Yet Another Ridiculous Acronym. Pick your choice.". https://twitter.com/plusvic/status/778983467627479040.
5. ↑ https://virustotal.github.io/yara-x/blog/yara-is-dead-long-live-yara-x/
6. ↑ https://virustotal.github.io/yara-x/blog/yara-x-is-stable/

## External links

* on GitHub
* YARA documentation

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/YARA. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=YARA&oldid=4297013"