yara

YARA is a pattern matching tool developed by VirusTotal, primarily aimed at helping malware researchers identify and classify malware samples. It enables users to create descriptions of malware families (or any other targets) based on textual or binary patterns. Each description, called a rule, consists of a set of strings and a boolean expression that determines its matching logic. Rules can include hex strings, text strings, and regular expressions, with support for wildcards, case-insensitive matching, and special operators. YARA is multi-platform, running on Windows, Linux, and Mac OS X, and can be used through its command-line interface or integrated into Python scripts via the yara-python extension. The project is currently in maintenance mode, with the team directing users toward YARA-X as the stable successor. Additional resources include YARA-CI for continuous testing of rules on GitHub, yextend for scanning compressed files, and a curated list of YARA-related tools. YARA is widely adopted across the security industry, with users including major security vendors such as Avast, ESET, Kaspersky, Trend Micro, McAfee, and Cisco Talos, as well as open-source projects like Cuckoo Sandbox, osquery, and Radare2.