The pattern matching swiss knife
C C++ Yacc Lex M4 Groff Other
Latest commit 784dba7 Jan 9, 2017 @plusvic plusvic Update grammars
Failed to load latest commit information.
dist Update RPM spec May 27, 2015
docs Spelling (#582) Dec 15, 2016
extra Convert logo to vectorial format Dec 10, 2015
libyara Update grammars Jan 9, 2017
m4 Spelling (#582) Dec 15, 2016
tests tests: Use larger file to demonstrate SIGBUS (#549) Oct 31, 2016
windows Update Visual Studio 2015 project Sep 23, 2016
.gitignore Move #include out of #ifdef Oct 20, 2016
.travis.yml travis: Build on Mac OS X (#537) Oct 13, 2016
AUTHORS Add Hilko Bengen to AUTHORS and CONTRIBUTORS May 13, 2015
CONTRIBUTORS Add Christian Blichmann to CONTRIBUTERS Feb 4, 2016
COPYING Change license to 3-clause BSD Jun 24, 2016 Don't unmask signals when setting up exception handler (Unix) (#546) Oct 31, 2016 Add Payload Security to “who’s using YARA” Jan 3, 2017
appveyor.yml Add appveyor config file Sep 23, 2016
args.c Spelling (#582) Dec 15, 2016
args.h Spelling (#582) Dec 15, 2016 Fix issues while building in some systems Dec 1, 2014 Improve build system Dec 3, 2013 Minor grammar error - singular / plural Nov 27, 2016
sample.file Change license to 3-clause BSD Jun 24, 2016
sample.rules Initial import Sep 26, 2008
threading.c removed __try block around CritSection Nov 14, 2016
threading.h Windows mutex replaced with CriticalSection Nov 11, 2016
yara.c Spelling (#582) Dec 15, 2016 Spelling (#582) Dec 15, 2016
yarac.c Remove C99-only structure initialization Nov 22, 2016 Implement —fail-on-warnings command-line argument Nov 22, 2016

Join the chat at Travis build status AppVeyor build status

YARA in a nutshell

YARA is a tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families (or whatever you want to describe) based on textual or binary patterns. Each description, a.k.a rule, consists of a set of strings and a boolean expression which determine its logic. Let's see an example:

rule silent_banker : banker
        description = "This is just an example"
        thread_level = 3
        in_the_wild = true

        $a = {6A 40 68 00 30 00 00 6A 14 8D 91}
        $b = {8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9}

        $a or $b or $c

The above rule is telling YARA that any file containing one of the three strings must be reported as silent_banker. This is just a simple example, more complex and powerful rules can be created by using wild-cards, case-insensitive strings, regular expressions, special operators and many other features that you'll find explained in YARA's documentation.

YARA is multi-platform, running on Windows, Linux and Mac OS X, and can be used through its command-line interface or from your own Python scripts with the yara-python extension.

If you plan to use YARA to scan compressed files (.zip, .tar, etc) you should take a look at yextend, a very helpful extension to YARA developed and open-sourced by Bayshore Networks.

Who's using YARA

Are you using it? Want to see your site listed here?