YARA helps security researchers identify and classify files using rules that describe recognisable characteristics. Its applications include malware analysis, incident response and searching collections of samples for related content.
Rules combine patterns with conditions that determine whether a match should be reported. Researchers can describe an entire malware family rather than relying on the checksum of an individual sample. Detection depends on the rules supplied; YARA does not provide a complete antivirus service or automatically remove threats.
The project is in maintenance mode, with development focused on its successor, YARA-X. Existing integrations and workflows that require process scanning remain reasons to use YARA.
This is free and open source software.
Key Features
- Scan individual files, directories and running processes from the command line.
- Recursively examine directory trees or scan paths supplied in a file list.
- Match text strings, hexadecimal byte sequences and regular expressions.
- Describe variable patterns using wildcards, alternatives, case-insensitive matching and string modifiers.
- Combine matches with Boolean expressions, occurrence counts, file offsets and file sizes.
- Extend detection rules with modules that expose structured information about executable files and other data.
- Compile rules in advance with yarac for reuse across scanning tasks.
- Organise rules using tags, metadata, namespaces and included rule files.
- Supply external variables to customise rule behaviour without editing the rules themselves.
- Display matching strings, rule metadata, tags and scanning statistics.
- Configure scanning threads, timeouts, file-size limits and symbolic-link handling.
- Integrate detection into applications through libyara and the yara-python extension.
- Cross-platform support – runs on Linux, macOS, and Windows.
Website: github.com/VirusTotal/yara
Support:
Developer: The YARA Authors
License: BSD 3-Clause ‘New’ or ‘Revised’ License
YARA is written in C. Learn C with our recommended free books and free tutorials.
Related Software
| Anti-Malware Tools | |
|---|---|
| ClamAV | Antivirus engine for detecting trojans, viruses, malware and other threats |
| YARA-X | Re-incarnation of YARA |
| YARA | Pattern matching swiss knife for malware researchers |
| Maltrail | Malicious traffic detection system |
| ClamTk | Graphical frontend for ClamAV |
| LMD | Malware scanner focusing on threats faced in shared hosted environments |
| phpMussel | PHP-based anti-virus anti-trojan anti-malware solution |
| Raspirus | Lightweight signature-based malware scanner |
| FastFinder | Fast suspicious file finder |
| chkrootkit | Locally checks for signs of a rootkit |
| Unhide | Forensic tool to find hidden processes and TCP/UDP ports |
| Atomdrift Scan | Malware and supply chain scanner for software security |
| paranoya | Malware scanner using indicators of compromise and YARA rules |
| decloaker | Security tool for revealing objects concealed by malware |
| Lenspect | Lightweight security threat scanner |
Read our verdict in the software roundup.
 LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software.We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README. |
Please read our Comment Policy before commenting.