◆ Malware Analysis

YARA

v4.6.0 open-source

YARA is a tool that helps malware researchers identify and classify malware samples using rules based on textual or binary patterns.

source ↗ website ↗ rss ↗ What is a cyber toolchain? last repo push Oct 27, 2026

yara --no-follow-symlinks rules.yar C:\Targets\
yara --disable-console-logs rules.yar target_file
yara --strict-escape rules.yar target_file
yara --skip-larger <threshold> <rules_file> <target_file>
yara --no-follow-links rules.yar /path/to/directory
echo 'rule test { strings: $a = "hello" condition: $a }' | yara - /tmp/sample.bin
yara --fail-on-warnings rules.yar target.bin
yr_compiler_add_fd(compiler, fd, NULL, NULL);
yara --print-module-data rules.yar target.bin
yr_rules_load_stream(rules_fp, &rules);
yara.match('rules.yar', 'target.bin', error_on_warning=True)

Summary

YARA is an open-source pattern-matching tool that helps malware researchers identify and classify malware samples by writing rules combining textual or binary patterns with boolean logic. It runs as a command-line scanner, matching rulesets against a single file or recursively across a directory, and can also be driven from Python scripts via the yara-python extension. It is built for malware analysts and threat researchers who need to fingerprint files by content rather than by hash. The project is multi-platform, running on Windows, Linux, and Mac OS X, and README notes complementary tools like YARA-CI for testing rules and yextend for scanning inside compressed archives. Now in maintenance mode as development shifts to YARA-X, it still sees active upkeep, with 250 contributors and a release cut just 24 days ago.

YARA is a tool that helps malware researchers identify and classify malware samples using rules based on textual or binary patterns.

How YARA helps

Which of my files contain a known-malicious pattern?

scans a file or directory recursively against a ruleset and reports every match by rule name and file path, down to the exact byte offset where the pattern occurred

Did a secret or hardcoded credential leak into my source tree?

matches string and boolean-logic rules against a codebase and names each file that contains the pattern, along with the matched string and its offset

Which files in this batch can I rule out so I only review the real hits?

tags every scanned file with a match count, letting the files that scored zero be filtered out and the remainder narrowed to the ones worth inspecting by hand

What exactly matched, and is it obfuscated or plaintext?

reports the matched string's length and offset and can compute an XOR key against the surrounding bytes, showing whether the content sits in the clear or was disguised

Which malware family does this sample belong to, based on more than its hash?

evaluates the sample's content against rules built from textual or binary patterns and boolean conditions, so a match holds even when the file has been repacked or renamed

Can I classify a sample from inside my own analysis pipeline rather than the command line?

the same ruleset and matching engine is callable from a Python script, returning matches programmatically so classification can run as a step in a larger tool

all 35 features, with the evidence for each →

Languages

Not documented

Features

35 capabilities across 4 capability groups · 4 backed by code, an API document or a real run

Built from YARA's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

YARA covers 4 of the 8 investigation and response capabilities we track.

Static malware analysis 5 features Investigation and response since 2014

ELF binary scanning shipped Enables the parsing and analysis of ELF (Executable and Linkable Format) file structures for pattern matching within YARA rules. 6 releases · 1 other source · first seen Nov 2014