PAGES
← all datasets
◆ Detection rules

YARA Rules

GPL-2.0

Community YARA rule collection for malware families, packers and exploit kits. Largely unmaintained since 2024 — useful as a broad baseline, not as current coverage.

Summary

This project covers the need of a group of IT Security Researchers to have a single repository where different Yara signatures are compiled, classified and kept as up to date as possible, and began as an open source community for collecting Yara rules. Our Yara ruleset is under the GNU-GPLv2 license and open to any user or organization, as long as you use it under this license.
from the project README
Formats
yara
License
GPL-2.0
Added
2026-09-10

Get it

From the project’s own instructions where it documents any; otherwise a plain clone.

  1. shell
    $ git clone --depth 1 https://github.com/Yara-Rules/rules

    Shallow clone: history isn’t needed for testing.

Contents

582 files 4.2 MB repository

  • .yar 523
  • .yara 43
  • (no ext) 6
  • .eml 3
  • .md 3
  • .yml 3
  • .sh 1

Use it with

Commands are curated, not yet run by us.

YARA — Scan a directory of your own files recursively with one rule file from the collection.

sample.yar
$ yara -r sample.yar samples/
browse all tools → score card for your toolchain →