Misplaced Pages

YARA

Article snapshot taken from Wikipedia with creative commons attribution-sharealike license. Give it a read and then ask your questions in the chat. We can research this topic together.
Rule-based malware analysis tool For other uses, see Yara (disambiguation).
YARA
Designed byVictor Alvarez
First appeared2013
Stable release4.5.2 Edit this on Wikidata / 10 September 2024; 3 months ago (10 September 2024)
Filename extensions.yara
Websitevirustotal.github.io/yara Edit this at Wikidata

YARA is a tool primarily used in malware research and detection.

It provides a rule-based approach to create descriptions of malware families based on regular expression, textual or binary patterns. A description is essentially a YARA rule name, where these rules consist of sets of strings and a Boolean expression.

History

YARA was originally developed by Victor Alvarez of VirusTotal and released on GitHub in 2013. The name is an abbreviation of YARA: Another Recursive Acronym or Yet Another Ridiculous Acronym.

Design

YARA by default comes with modules to process PE, ELF analysis, as well as support for the open-source Cuckoo sandbox.

See also

References

  1. "Release 4.5.2". 10 September 2024. Retrieved 26 September 2024.
  2. "Welcome to YARA's documentation!". yara.readthedocs.io. Retrieved 2023-09-18.
  3. "Release v1.7.1". GitHub.
  4. Victor M. Alvarez (22 September 2016). "@milliped @yararules YARA is an acronym for: YARA: Another Recursive Acronym, or Yet Another Ridiculous Acronym. Pick your choice" (Tweet) – via Twitter.

External links

Stub icon

This malware-related article is a stub. You can help Misplaced Pages by expanding it.

Categories: