Awesome YARA

A curated list of awesome YARA rules, tools, and resources. Inspired by awesome-python and awesome-php.

YARA is an ancronym for: YARA: Another Recursive Ancronym, or Yet Another Ridiculous Acronym. Pick your choice.

-- Victor M. Alvarez (@plusvic)

YARA, the "pattern matching swiss knife for malware researchers (and everyone else)" is developed by @plusvic and @VirusTotal. View it on GitHub.

Contents

• Rules
• Tools
• Services
• Syntax Highlighters
• People
• Related Awesome Lists
• Contributing
• Just for Fun

Legend

• 👀 - Actively maintained, a repository worth watching.
• 💎 - Novel, interesting, educational, or otherwise stand-out content.
• ✨ - Added in the past 6 months, shiny new toys.
• 🏆 - The biggest collection award, awarded to a single repo.

Rules

• AlienVault Labs Rules
  • Collection of tools, signatures, and rules from the researchers at AlienVault Labs. Search the repo for .yar and .yara extensions to find about two dozen rules ranging from APT detection to generic sandbox / VM detection. Last updated in January of 2016.
• Apple OSX
  • Apple has ~40 YARA signatures for detecting malware on OSX. The file, XProtect.yara, is available locally at /System/Library/CoreServices/XProtect.bundle/Contents/Resources/.
• bamfdetect rules
  • Custom rules from Brian Wallace used for bamfdetect, along with some rules from other sources.
• bartblaze YARA rules 👀
  • Collection of personal YARA rules
• BinaryAlert YARA Rules
  • A couple dozen rules written and released by AirBnB as part of their BinaryAlert tool (see next section). Detection for hack tools, malware, and ransomware across Linux, Window, and OS X. This is a new and active project.
• Burp YARA Rules
  • Collection of YARA rules intended to be used with the Burp Proxy through the Yara-Scanner extension. These rules focus mostly on non-exe malware typically delivered over HTTP including HTML, Java, Flash, Office, PDF, etc. Last updated in June of 2016.
• BinSequencer
  • Find a common pattern of bytes within a set of samples and generate a YARA rule from the identified pattern.
• CAPE Rules 👀
  • Rules from various authors bundled with the Config And Payload Extraction Cuckoo Sandbox extension (see next section).
• CDI Rules
  • Collection of YARA rules released by CyberDefenses for public use. Built from information in intelligence profiles, dossiers and file work.
• Citizen Lab Malware Signatures
  • YARA signatures developed by Citizen Lab. Dozens of signatures covering a variety of malware families. The also inclde a syntax file for Vim. Last update was in November of 2016.
• ConventionEngine Rules ✨
  • A collection of Yara rules looking for PEs with PDB paths that have unique, unusual, or overtly malicious-looking keywords, terms, or other features.
• Deadbits Rules 👀
  • A collection of YARA rules made public by Adam Swanda, Splunk's Principal Threat Intel. Analyst, from his own recent malware research.
• Didier Stevens Rules 💎
  • Collection of rules from Didier Stevens, author of a suite of tools for inspecting OLE/RTF/PDF. Didier's rules are worth scrutinizing and are generally written purposed towards hunting. New rules are frequently announced through the NVISO Labs Blog.
• ESET IOCs 👀
  • Collection of YARA and Snort rules from IOCs collected by ESET researchers. There's about a dozen YARA Rules to glean from in this repo, search for file extension .yar. This repository is seemingly updated on a roughly monthly interval. New IOCs are often mentioned on the ESET WeLiveSecurity Blog.
• Fidelis Rules
  • You can find a half dozen YARA rules in Fidelis Cyber's IOC repository. They update this repository on a roughly quarterly interval. Complete blog content is also available in this repository.
• Florian Roth Rules 👀 💎
  • Florian Roth's signature base is a frequently updated collection of IOCs and YARA rules that cover a wide range of threats. There are dozens of rules which are actively maintained. Watch the repository to see rules evolve over time to address false potives / negatives.
• Florian Roth's IDDQD Rule
  • A proof-of-concept rule that shows how easy it actually is to detect red teamer and threat group tools and code.
• Franke Boldewin Rules
  • A collection of YARA Rules from @r3c0nst.
• FSF Rules
  • Mostly filetype detection rules, from the EmersonElectricCo FSF project (see next section).
• GoDaddy ProcFilter Rules
  • A couple dozen rules written and released by GoDaddy for use with ProcFilter (see next section). Example rules include detection for packers, mimikatz, and specific malware.
• h3x2b Rules 💎
  • Collection of signatures from h3x2b which stand out in that they are generic and can be used to assist in reverse engineering. There are YARA rules for identifying crypto routines, highly entropic sections (certificate discovery for example), discovering injection / hooking functionality, and more.
• Icewater Rules
  • Repository of automatically generated YARA rules from Icewater.io. This repository is updated rapidly with newly generated signatures that mostly match on file size range and partial content hashes.
• Intezer Rules ✨
  • YARA rules published by Intezer Labs.
• InQuest Rules 👀
  • YARA rules published by InQuest researchers mostly geared towards threat hunting on Virus Total. Rules are updated as new samples are collected and novel pivots are discovered. The InQuest Blog will often discuss new findings.
• jeFF0Falltrades Rules ✨
  • A collection of YARA signatures for various malware families.
• kevthehermit Rules
  • Dozens of rules from the personal collection of Kevin Breen. This repository hasn't been updated since February of 2016.
• Koodous Community Rules
  • Community-contributed rules for Android APK malware.
• lw-yara
  • Ruleset for scanning Linux servers for shells, spamming, phishing and other webserver baddies.
• NCC Group Rules 👀
  • A handful of YARA rules released by NCC Group's Cyber Defence team.
• Malice.IO YARA Plugin Rules 👀
  • Collection of topical from a variety of sources for the YARA component of the Malice.IO framework.
• Malpedia Auto Generated Rules ✨
  • A zip file that contains all automatically generated, code-based rules created using Malpedia's YARA-Signator
• McAfee Advanced Threat Research IOCs
  • IOCs, including YARA rules, to accompany McAfee ATR's blog and other public posts.
• McAfee Advanced Threat Research Yara-Rules
  • Repository of YARA rules made by McAfee ATR Teams.
• mikesxrs YARA Rules Collection 👀 🏆
  • Large collection of open source rules aggregated from a variety of sources, including blogs and other more ephemeral sources. Over 100 categories, 1500 files, 4000 rules, and 20Mb. If you're going to pull down a single repo to play with, this is the one.
• Patrick Olsen Rules 💎
  • Small collection of rules with a wide footprint for variety in detection. RATs, documents, PCAPs, executables, in-memory, point-of-sale malware, and more. Unfortunately this repository hasn't seen an update since late 2014.
• QuickSand Lite Rules
  • This repo contains a C framework and standalone tool for malware analysis, along with several useful YARA rules developed for use with the project.
• Rastrea2r
  • Triage suspect systems and hunt for Indicators of Compromise (IOCs) across thousands of endpoints in minutes.
• ReversingLabs YARA Rules ✨ 👀
  • A collection of yara rules published by ReversingLabs which covers exploits, infostealers, ransomeware, trojans, and viruses.
• Sophos AI YaraML Rules
  • A repository of Yara rules created automatically as translations of machine learning models. Each directory will have a rule and accompanying metadata: hashes of files used in training, and an accuracy diagram (a ROC curve).
• SpiderLabs Rules
  • Repository of tools and scripts related to malware analysis from the researchers at SpiderLabs. There's only three YARA rules here and the last update was back in 2015, but worth exploring.
• Tenable Rules
  • Small collection from Tenable Network Security.
• TjadaNel Rules
  • Small collection of malware rules.
• VectraThreatLab Rules
  • YARA rules for identifying anti-RE malware techniques.
• x64dbg Signatures 💎
  • Collection of interesting packer, compiler, and crypto identification signatures.
• YARA-FORENSICS
  • Collection of file type identfiying rules.
• yara4pentesters
  • Rules to identify files containing juicy information like usernames, passwords etc.
• YaraRules Project Official Repo 👀
  • Large collection of rules constantly updated by the community.
• Yara-Unprotect
  • Rules created for the Unprotect Project for detecting malware evasion techniques.

Tools

• AirBnB BinaryAlert
  • Open-source serverless AWS pipeline where any file uploaded to an S3 bucket is immediately scanned with a configurable set of YARA rules.
• androguard
  • YARA module that integrates APK analysis.
• bamfdetect
  • Identifies and extracts information from bots and other malware.
• base64_substring
  • Generate YARA rules to match terms against base64-encoded data.
• CAPE: Config And Payload Extraction 👀
  • Extension of Cuckoo specifically designed to extract payloads and configuration from malware. CAPE can detect a number of malware techniques or behaviours, as well as specific malware families, from its initial run on a sample. This detection then triggers a second run with a specific package, in order to extract the malware payload and possibly its configuration, for further analysis.
• clara ✨
  • Serverless, real-time, ClamAV+Yara scanning for your S3 Buckets.
• CrowdStrike Feed Management System
  • Framework for automating collection and processing of samples from VirusTotal, and executing commands based on YARA rule matches.
• CSE-CST AssemblyLine
  • The Canadian Communications Security Establishment (CSE) open sourced AssemblyLine, a platform for analyzing malicious files. The component linked here provides an interface to YARA.
• dnYara
  • A multi-platform .NET wrapper library for the native YARA library.
• ELAT
  • Event Log Analysis Tool that creates/uses YARA rules for Windows event log analysis.
• Emerson File Scanning Framework (FSF)
  • Modular, recursive file scanning solution.
• findcrypt-yara and FindYara
  • IDA pro plugins to scan your binary with YARA rules to find crypto constants (and more).
• Fnord
  • Pattern extractor for obfuscated code.
• generic-parser
  • Parser with YARA support, to extract meta information, perform static analysis and detect macros within files.
• GoDaddy ProcFilter 💎
  • ProcFilter is a process filtering system for Windows with built-in YARA integration. YARA rules can be instrumented with custom meta tags that tailor its response to rule matches. It runs as a Windows service and is integrated with Microsoft's ETW API, making results viewable in the Windows Event Log. Installation, activation, and removal can be done dynamically and does not require a reboot.
• go-yara
  • Go bindings for YARA.
• Hyara
  • IDAPro plugin providing easy creation of YARA rules for ASCII & hex strings between a given start and end address.
• IDA_scripts
  • IDA Python scripts for generating YARA sigs from executable opcodes (.NET included).
• ida_yara
  • Scan data within an IDB using YARA.
• ida-yara-processor
  • IDA processor for compiled YARA rules.
• InQuest ThreatKB
  • Knowledge base workflow management for YARA rules and C2 artifacts (IP, DNS, SSL).
• iocextract
  • Advanced Indicator of Compromise (IOC) extractor, with YARA rule extraction.
• Invoke-Yara
  • Powershell scripts to run YARA on remote machines.
• KLara
  • Distributed system written in Python, allows researchers to scan one or more YARA rules over collections with samples.
• Laika BOSS
  • Object scanner and intrusion detection system that strives to achieve the following goals: Scalable, Flexible, Verbose.
  • Whitepaper
• MalConfScan
  • MalConfScan is a Volatility plugin extracts configuration data of known malware. This tool searches for malware in memory images and dumps configuration data. In addition, this tool has a function to list strings to which malicious code refers.
• Malice
  • Open source VirusTotal alternative, with YARA support.
• malscan
  • Scan process memory for YARA matches and execute Python scripts if a match is found.
• MISP Threat Sharing
  • Threat intelligence platform including indicators, threat intelligence, malware samples and binaries. Includes support for sharing, generating, and validating YARA signatures.
• MITRE MultiScanner
  • File analysis framework that assists the user in evaluating a set of files by automatically running a suite of tools for the user and aggregating the output.
• mkYARA
  • Generate YARA rules based on binary code.
• mquery
  • Web frontend for running blazingly fast YARA queries on large datasets.
• Nextron Systems OSS and Commercial Tools (Florian Roth: @Neo23x0)
  • Loki IOC and YARA rule scanner implemented in Python. Open source and free.
  • THOR Lite IOC and YARA rule scanner implemented in Go. Closed source, free, but registration required.
• node-yara
  • YARA support for Node.js.
• OCYara
  • Performs OCR on image files and scans them for matches to YARA rules.
• PasteHunter
  • Scan pastebin.com with YARA rules.
• plast
  • Threat hunting tool for detecting and processing IOCs using YARA under the hood.
• plyara
  • Parse YARA rules with Python.
• Polichombr
  • Collaborative malware analysis framework with YARA rule matching and other features.
• PwC Cyber Threat Operations rtfsig
  • This tool is designed to make it easy to signature potentially unique parts of RTF files.
• VirusTotalTools
  • Tools for checking samples against Virus Total, including VT_RuleMGR, for managing threat hunting YARA rules.
• QuickSand.io
  • Compact C framework to analyze suspected malware documents. Also includes a web interface and online analysis.
• shotgunyara
  • Given a string, create 255 xor encoded versions of that string as a YARA rule.
• spyre
  • Simple, self-contained YARA-based file IOC scanner.
• static_file_analysis
  • Analyze deeply embedded files (doc, pdf, exe, ...) with clamscan and YARA.
• stoQ
  • Modular and highly customizable framework for the creation of data sets from multiple disparate data sources.
• Strelka
  • Detection-Oriented File Analysis System built on Python3, ZeroMQ, and YARA, primarily used for threat detection/hunting and intelligence gathering.
• SwishDbgExt
  • Microsoft WinDbg extension which includes the ability to use YARA rules to hunt processes in memory.
• ThreatIngestor
  • Automatically extract and aggregate IOCs including YARA rules from many sources.
• UXProtect
  • The missing UI to Apple's built-in XProtect YARA signatures. Enumerate signatures, scan files, and more.
• VTCodeSimilarity-YaraGen 💎 ✨
  • Yara rule generator using VirusTotal code similarity feature code-similar-to: written by @arieljt.
• Vxsig ✨
  • Automatically generate AV byte signatures from sets of similar binaries.
• yabin
  • Creates YARA signatures from executable code within malware.
• yaml2yara
  • Generate bulk YARA rules from YAML input.
• yara-endpoint
  • Tool useful for incident response as well as anti-malware enpoint based on YARA signatures.
• Yara Finder
  • Web API and docker image for scanning files against YARA rules, built on @tylerha97's yara_scan.
• YaraGenerator
  • Quick, simple, and effective yara rule creation to isolate malware families and other malicious objects of interest.
• YaraGen and yara_fn
  • Plugins for x64dbg and IDAPython, respectively, that generate YARA rules from function blocks.
• YaraGuardian
  • Django web inerface for managing YARA rules.
• yaraMail
  • YARA scanner for IMAP feeds and saved streams.
• Yara Malware Quick menu scanner
  • Adds the awsome YARA pattern scanner to Windows right click menus.
• YaraManager
  • Web based manager for YARA rules.
• yaramod
  • A library that provides parsing of YARA rules into AST and a C++ programming interface to build new YARA rulesets.
• yarAnalyzer
  • YARA rule set coverage analyzer.
• yara-parser
  • Tools for parsing rulesets using the exact grammar as YARA. Written in Go.
• yaraPCAP
  • YARA scanner For IMAP feeds and saved streams.
• yara-procdump-python
  • Python extension to wrap the YARA process memory access API.
• yara-signator ✨
  • Automatic YARA rule generation for Malpedia
• YARA-sort
  • Aggregate files into collections basd on YARA rules. blog
• Yara Python ICAP Server
  • ICAP server with YARA scanner.
• yarasafe
  • Automatic generation of function signature using machine learning.
• Yara-Scanner
  • Python-based extension that integrates a YARA scanner into Burp Suite.
• yarascanner
  • Golang-based web service to scan files with YARA rules.
• yara_tools
  • Python bindings to author YARA rules using natural Python conventions.
• Yara-Validator
  • Validates YARA rules and tries to repair the broken ones.
• yaraVT
  • Scan files with Yara and send rule matches to VirusTotal reports as comments.
• yara_zip_module
  • Search for strings inside a zip file.
• yarGen
  • YARA rule generator for finding related samples and hunting.
• yaya
  • Automatically curate open source yara rules and run scans.
• YaYaGen
  • YARA rule generator for Android malware.
• Yeti
  • Platform meant to organize observables, indicators of compromise, TTPs, and knowledge on threats in a single, unified repository.
• yextend
  • YARA integrated software to handle archive file data.
• yaraZeekAlert ✨
  • Scans files with YARA rules and send email alerts which include network context of the file transfer and attaches the suspicious file if it is less than 10 MB.

Services

• Hybrid Analysis YARA Search
  • YARA search / hunting from CrowdStrike / Hybrid Analysis, powered by Falcon MalQuery.
• InQuest Labs ✨ 💎
  • See the YARA section for helper routines to convert regular expressions to match on base64 encoded strings, conver strings to sequences of uint() lookups, and more.
• Koodous
  • Collaborative platform for APK analysis, with community YARA rule repository and large APK sample dataset.
• MalShare
  • Free malware repository providing researchers access to samples, malicous feeds, and YARA results.
• MalwareConfig
  • Extract IOCs from Remote Access Trojans.
• YaraEditor (Web)
  • All-in-one website to create and manage YARA rules.
• Yara Share
  • Free repository and online community for users to upload and share Yara rules.

Syntax Highlighters

• Atom: language-yara
• GTK-based editors, like gedit and xed: GtkSourceView-YARA
• Sublime Text: YaraSyntax
• Vim: vim-yara
• Visual Studio Code: textmate-yara

People

We're aggregating the Twitter handles for anyone involved with the projects on this page into a single list: awesome-yara Twitter list. Do let us know if anyone is missing.

Related Awesome Lists

• Crawler
• CVE PoC
• Forensics
• Hacking
• HackwithGithub
• Honeypots
• Incident-Response
• Infosec
• IOCs
• Malware Analysis
• ML for Cyber Security
• OSINT
• PCAP Tools
• Pentesting
• Reversing
• Security
• Static Analysis
• Threat Detection
• Threat Intelligence

Contributing

This list is maintained by InQuest. Feel free to let us know about anything we're missing!

See CONTRIBUTING.md.