Awesome YARA
A curated list of awesome YARA rules, tools, and resources. Inspired by awesome-python and awesome-php.
YARA is an ancronym for: YARA: Another Recursive Ancronym, or Yet Another Ridiculous Acronym. Pick your choice.
-- Victor M. Alvarez (@plusvic)
YARA, the "pattern matching swiss knife for malware researchers (and everyone else)" is developed by @plusvic and @VirusTotal. View it on GitHub.
Contents
Legend
- 👀 - Actively maintained, a repository worth watching.
- 💎 - Novel, interesting, educational, or otherwise stand-out content.
- ✨ - Added more recently, shiny new toys.
- 🏆 - The biggest collection award, awarded to a single repo.
100 Days of YARA (#100DaysofYARA)
An annual YARA challenge started by Greg Lesnewich in 2022, inspired by #100DaysOfCode and taking place in the first 100 days of the year. The goal is to contribute daily to the YARA community through rule creation, source code contributions, or generally teaching/help your colleagues. Other key contributors include Wesley Shields and Steve Miller. For a list of all participants in the first two years of the challenge, see our Twitter List.
Rule collections from prior years of the challenge: 100 Days of YARA
Guides
Rules
- AlienVault Labs Rules
- Collection of tools, signatures, and rules from the researchers at AlienVault Labs. Search the repo for .yar and .yara extensions to find about two dozen rules ranging from APT detection to generic sandbox / VM detection. Last updated in January of 2016.
- anyrun rules
- Apple OSX
- Apple has ~40 YARA signatures for detecting malware on OSX. The file, XProtect.yara, is available locally at /System/Library/CoreServices/XProtect.bundle/Contents/Resources/.
- bartblaze YARA rules 👀
- Collection of personal YARA rules
- BinaryAlert YARA Rules
- A couple dozen rules written and released by AirBnB as part of their BinaryAlert tool (see next section). Detection for hack tools, malware, and ransomware across Linux, Window, and OS X. This is a new and active project.
- Burp YARA Rules
- Collection of YARA rules intended to be used with the Burp Proxy through the Yara-Scanner extension. These rules focus mostly on non-exe malware typically delivered over HTTP including HTML, Java, Flash, Office, PDF, etc. Last updated in June of 2016.
- BinSequencer
- Find a common pattern of bytes within a set of samples and generate a YARA rule from the identified pattern.
- CAPE Rules 👀
- Rules from various authors bundled with the Config And Payload Extraction Cuckoo Sandbox extension (see next section).
- CDI Rules
- Collection of YARA rules released by CyberDefenses for public use. Built from information in intelligence profiles, dossiers and file work.
- AIDebug
- AI-assisted malware reverse-engineering debugger that emits analyst-review YARA candidates, ATT&CK mappings, IOCs, JSON, and HTML reports.
- AirBnB BinaryAlert
- Open-source serverless AWS pipeline where any file uploaded to an S3 bucket is immediately scanned with a configurable set of YARA rules.
- alterix
- Converts Yara rules to the query language of CRYPTTECH's SIEM
- androguard-yara
- Androguard module for Yara.
- APKiD
- Android Application Identifier for Packers, Protectors, Obfuscators and Oddities - PEiD for Android
- a-ray-grass
- YARA module that provides support for bloom filters in yara. In the context of hashlookup.io, it allows to quickly discard known files before any further analysis.
- Arya- The Reverse YARA
- Arya is a unique tool that produces pseudo-malicious files meant to trigger YARA rules. You can think of it like a reverse YARA because it does exactly the opposite - it creates files that matches your rules.
- Audit Node Modules With YARA Rules
- Run a given set of YARA rules against the given node_module folder
- AutoYara
- Automated Yara Rule generation using Biclustering
- base64_substring
- Generate YARA rules to match terms against base64-encoded data.
- bincapz
- Enumerates program capabilities and malicious behaviors using fragment analysis..
- CAPE: Config And Payload Extraction 👀
Services
- Hybrid Analysis YARA Search
- YARA search / hunting from CrowdStrike / Hybrid Analysis, powered by Falcon MalQuery.
- InQuest Labs ✨ 💎
- See the YARA section for helper routines to convert regular expressions to match on base64 encoded strings, conver strings to sequences of uint() lookups, and more.
- Koodous
- Collaborative platform for APK analysis, with community YARA rule repository and large APK sample dataset.
- MalShare
- Free malware repository providing researchers access to samples, malicous feeds, and YARA results.
- MalwareConfig
- Extract IOCs from Remote Access Trojans.
- YaraEditor (Web)
- All-in-one website to create and manage YARA rules.
- YARAify✨
- YARAify is a project from abuse.ch that allows anyone to scan suspicious files such as malware samples or process dumps against a large repository of YARA rules.
- Yara Scan Service
- A simple service to test your Yara rules against a large set of malicious and identified files.
Syntax Highlighters
People
We're aggregating the Twitter handles for anyone involved with the projects on this page into a single list: awesome-yara Twitter list. Do let us know if anyone is missing.
Videos and Talks
Contributing
This list is maintained by InQuest. Feel free to let us
know about anything we're missing!
See CONTRIBUTING.md.
Contributors
pedramamini/awesome-yara
