YARA

You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert Latest commit JosiahRaySmith Merge pull request 76 from Karib0u/add-rustinel Open commit details Jun 15, 2026 5f50235 · Jun 15, 2026 History 364 Commits Open commit details 364 Commits .travis.yml .travis.yml Add awesome bot config Oct 18, 2017 CONTRIBUTING.md CONTRIBUTING.md Add contributing file Feb 28, 2018 LICENSE LICENSE Initial commit Oct 17, 2017 README.md README.md Merge pull request 76 from Karib0u/add-rustinel Jun 15, 2026 README CN.md README CN.md Update of README CN.md Jul 25, 2024 awesome-yara.png awesome-yara.png Add image to header Sep 4, 2018 View all files A curated list of awesome YARA rules, tools, and resources. Inspired by awesome-python and awesome-php . YARA is an ancronym for: YARA: Another Recursive Ancronym, or Yet Another Ridiculous Acronym. Pick your choice. An annual YARA challenge started by Greg Lesnewich in 2022, inspired by 100DaysOfCode and taking place in the first 100 days of the year. The goal is to contribute daily to the YARA community through rule creation, source code contributions, or generally teaching/help your colleagues. Other key contributors include Wesley Shields and Steve Miller . For a list of all participants in the first two years of the challenge, see our Twitter List . AIDebug AI-assisted malware reverse-engineering debugger that emits analyst-review YARA candidates, ATT&CK mappings, IOCs, JSON, and HTML reports. AirBnB BinaryAlert Open-source serverless AWS pipeline where any file uploaded to an S3 bucket is immediately scanned with a configurable set of YARA rules. alterix Converts Yara rules to the query language of CRYPTTECH's SIEM androguard-yara Androguard module for Yara. APKiD Android Application Identifier for Packers, Protectors, Obfuscators and Oddities - PEiD for Android a-ray-grass YARA module that provides support for bloom filters in yara. In the context of hashlookup.io , it allows to quickly discard known files before any further analysis. Arya- The Reverse YARA Arya is a unique tool that produces pseudo-malicious files meant to trigger YARA rules. You can think of it like a reverse YARA because it does exactly the opposite - it creates files that matches your rules. Audit Node Modules With YARA Rules Run a given set of YARA rules against the given node module folder AutoYara Automated Yara Rule generation using Biclustering base64 substring Generate YARA rules to match terms against base64-encoded data. bincapz Enumerates program capabilities and malicious behaviors using fragment analysis.. CAPE: Config And Payload Extraction 👀 Extension of Cuckoo specifically designed to extract payloads and configuration from malware. CAPE can detect a number of malware techniques or behaviours, as well as specific malware families, from its initial run on a sample. This detection then triggers a second run with a specific package, in order to extract the malware payload and possibly its configuration, for further analysis. CCCS-Yara YARA rule metadata specification and validation utility. clara ✨ Serverless, real-time, ClamAV+Yara scanning for your S3 Buckets. Cloudina Security Hawk ✨ nullsec-yara YARA rule development toolkit with rule generation, optimization, and testing capabilities. Multi Cloud antivirus scanning API based on CLAMAV and YARA for AWS S3, AZURE Blob Storage, GCP Cloud Storage. CrowdStrike Feed Management System Framework for automating collection and processing of samples from VirusTotal, and executing commands based on YARA rule matches. CSE-CST AssemblyLine The Canadian Communications Security Establishment (CSE) open sourced AssemblyLine , a platform for analyzing malicious files. The component linked here provides an interface to YARA. decompressingyara For when your malware samples are stored compress

The above rule is telling YARA that any file containing one of the three strings must be reported as silent banker . This is just a simple example, more complex and powerful rules can be created by using wild-cards, case-insensitive strings, regular expressions, special operators and many other features that you'll find explained in YARA's documentation. YARA is multi-platform, running on Windows, Linux and Mac OS X, and can be used through its command-line interface or from your own Python scripts with the yara-python extension. Do you use GitHub for storing your YARA rules? YARA-CI may be a useful addition to your toolbelt. This is GitHub application that provides continuous testing for your rules, helping you to identify common mistakes and false positives. If you plan to use YARA to scan compressed files (.zip, .tar, etc) you should take a look at yextend, a very helpful extension to YARA developed and open-sourced by Bayshore Networks. Additionally, the guys from InQuest have curated an awesome list of YARA-related stuff. 0x101 Cyber Security Adlice AlienVault Avast BAE Systems Bayshore Networks, Inc. Binalyze BinaryAlert Blueliv Cado Security Cisco Talos Intelligence Group Cloudina Security Cofense Conix Corelight CounterCraft Cuckoo Sandbox Cyber Triage Cybereason Digita Security Dragos Platform Dtex Systems ESET ESTsecurity Elastic Security FactorX.ai Fidelis XPS FireEye, Inc. Forcepoint Fox-IT FSF Guidance Software Heroku Hornetsecurity ICS Defense InQuest IntelOwl Joe Security Kaspersky Lab KnowBe4 Koodous Laika BOSS Lastline, Inc. libguestfs LimaCharlie Malpedia Malwation McAfee Advanced Threat Defense Metaflows NBS System ndaal NetLock Nextron Systems Nozomi Networks osquery Payload Security PhishMe Picus Security Radare2 RedSocks Security ReversingLabs Scanii SecondWrite SonicWall SpamStopsHere Spyre stoQ Sublime Security SumoLogic Tanium Tenable Network Security Tenzir The DigiTrust Group ThreatConnect ThreatStream, Inc. Thug Threat.Zone TouchWeb Trend Micro UnpacMe UpSight Security Inc. Uptycs Inc Veeam Verisys Antivirus API VirusTotal Intelligence VMRay Volexity We Watch Your Website x64dbg YALIH