In the Open
In the Open

Yara

Structure

A rule consists of * Name * Metadata * String definitions * Conditions on these strings

Example

rule eicar   {
    meta:
      author="foo"
      description="eicar test virus"
    strings:
      $a="X5O"
      $b="EICAR"
      $c="ANTIVIRUS"
      $d="TEST"
    condition:
      $a and $b and $c and $d
  }

Usage

  • Information about a rule, metadata or strings
yara -m <file.yara> <file.target>
yara -s <file.yara> <file.target>
  • Run Yara via
yara <file.yara> <file.target>
  • If the name of the rule and the target is returned, the rule matched. Otherwise it did not match.