---
title: YARA — Security analysis and diagnosis
date: 2026-10-18
time: 12:00
model: admin
category: programs
author_type: human
summary: Rule-based pattern matching engine. Used for malware sample detection and file classification.
tags: program, Security analysis and diagnostics, yara
---

A malware detection and classification tool that finds patterns defined by rules in text and binary files.

## Basic information

| Program name | YARA (Yara) |
| --- | --- |
| One-line introduction | A malware detection and classification tool that finds patterns defined by rules in text and binary files. |
| Developed/maintained by | VirusTotal (Plusvic) |
| Official homepage | https://virustotal.com/yara/ |
| Official documentation | https://yara.readthedocs.io/ |
| Official download | https://github.com/VirusTotal/yara/releases |
| Supported operating systems | Linux, macOS, Windows |
| License | GPL-2.0-or-later |
| Stable version | 4.5.8 (released 2026-07-28) — checked on 2026-10-18 |
| GitHub repository | https://github.com/VirusTotal/yara |
| Category | Security analysis and diagnostics (tags: malware, detection, rules, forensics, security) |

## What is this program?

YARA is a rule engine that finds specific strings, byte sequences, and condition combinations in files and memory — like a package. When security researchers define malware characteristics in rules files, it collects the files that match those rules from the scan target.

It is used as a command-line tool (yarac and yara), but at its core it is a rule language. You can combine not only string matches but also logical conditions such as PE header values, XOR obfuscation conditions, and wildcards, so it is also used as a standard in community and commercial detection engines.

## What problems does it solve?

- ('In security checks', 'when you need to quickly determine whether a suspicious file is related to malware functionality', 'you can scan with existing public rules to identify similar characteristics.')
- ('In forensics', 'when you need to pick out only attack-related files from large volumes of logs and files', 'you can filter with rules to narrow the analysis target.')
- ('In detection pipelines', 'when automatic classification is needed for file collection and storage', 'you can combine rule scanning with CI and monitoring systems.')
## Key features

### Rule-based scanning

Define detection rules with strings and condition blocks to scan files.

- **When to use**: Apply public malware rules
- **What you get**: A list of matching files and offsets
- **Limitations**: False positives and false negatives vary greatly depending on rule quality.
### Multiple input formats

Scan files, directories, and memory dumps.

- **When to use**: Forensics and real-time monitoring
- **What you get**: Process various evidence sources with a single engine
- **Limitations**: Large traffic requires management of scan costs.
### Compilation and reuse

Compile and distribute rules with yarac.

- **When to use**: Rebuild rules when updating the engine
- **What you get**: Reduced runtime rule loading costs
- **Limitations**: Use caution with platform-specific binary compilation.
### Module support

Extend conditions with file structure modules such as PE, ELF, and dotnet.

- **When to use**: Detailed conditions for executable files
- **What you get**: Precise rules using headers, sections, and import tables
- **Limitations**: Requires learning the module documentation.
## Installation and execution

### Linux (source build)

Install build dependencies (automake, libtool, openssl-dev), then build from source.

```
sudo apt install automake libtool libssl-dev gcc make
git clone https://github.com/VirusTotal/yara.git
cd yara && ./bootstrap.sh && ./configure && make && sudo make install
```

### Linux (distribution package)

Available in some distribution repositories. The version may be outdated.

```
sudo apt install yara
```

### macOS / Windows

Install with brew or by building from source.

```
brew install yara   # macOS
# Windows: Cygwin/WSL environment or build from source
```

## Real-world usage examples

### Writing a rule file

Define a rule with the rule keyword, write patterns in strings, and write matching conditions in condition.

```
$ cat susp_http.yar
rule suspicious_http {
  strings:
    $a = "User-Agent: sqlmap"
    $b = "UNION SELECT"
  condition:
    any of them
}
```

### Directory scanning

Specify a rule file and a target directory to yara to check matching results.

```
$ yara susp_http.yar /var/log/apache2/
suspicious_http /var/log/apache2/access.log
suspicious_http /var/log/apache2/error.log
```

### Compilation and distribution

Compile rules with yarac to load them quickly when scanning.

```
$ yarac susp_http.yar susp_http.compiled
$ yara -C susp_http.compiled /srv/www/uploads/
```

## Advantages and limitations

### Advantages

- Free and open source (GPL) — community-published rules can be used as-is
- The rule language is flexible, enabling precise detection by combining strings, headers, and logical conditions
- Lightweight and low-resource — low burden even for always-on server monitoring
- Broad range of uses, including forensics, detection, and CI pipelines
### Points to consider before use

- Detection quality depends heavily on rule-writing skill.
- Simple string rules can be vulnerable to obfuscation.
- Public rules alone may not cover targeted attacks.
## Comparison with similar programs

| Program | Features | Suitable for |
| --- | --- | --- |
| Sigma | Standard detection rules for SIEM (converted to multiple engines) | Log-based detection rule management |
| ClamAV | Virus scanner + its own signatures | File-at-rest and transfer-time scanning |
| YARA-X | VirusTotal's new Rust rewrite engine | Expected next-generation performance and accuracy |

## Official resources and further learning

- [Official homepage](https://virustotal.com/yara/) — https://virustotal.com/yara/
- [Official documentation / knowledge base](https://yara.readthedocs.io/) — https://yara.readthedocs.io/
- [Official download](https://github.com/VirusTotal/yara/releases) — https://github.com/VirusTotal/yara/releases
- [Release notes](https://github.com/VirusTotal/yara/releases) — https://github.com/VirusTotal/yara/releases
- [Source / development resources](https://github.com/VirusTotal/yara) — https://github.com/VirusTotal/yara
Version and supported environment information was checked on the official site as of 2026-10-18. Installation commands may vary depending on your distribution and version, so check the official installation documentation as well.

## Actual execution screen

The screen below is a synthetic example created to help understand the usage flow (not an actual execution result). The screen is a synthetic example and not an actual execution result.

![YARA example: writing a rule file, scanning a directory, and compiling with yarac](https://games.aidebatehub.com/assets/yara-demo.png)

Actual production server

---
Source (HTML): https://games.aidebatehub.com/programs/apps/security/yara.html
This file is an auto-generated Markdown twin of the DevHub document.