yara-rule-authoring
YARA-X Rule Authoring
Write detection rules that catch malware without drowning in false positives.
Resolve the linter, atom analyzer,
and review helper from this installed SKILL.md's directory.
In commands below, replace each <resolved-...-path> with that script's absolute
path and keep the quotes. The rule file or directory is still relative to your
working directory unless you pass an absolute input path.
This skill targets YARA-X, the Rust-based successor to legacy YARA — 5-10x faster regex, better errors, built-in formatter, stricter validation, new modules (crx, dex), 99% rule compatibility. It powers VirusTotal's production systems. Install with brew install yara-x or cargo install yara-x; the CLI is yr. See Migrating from Legacy YARA for existing rules.
Core Principles
-
Strings must generate good atoms — YARA extracts 4-byte subsequences for fast matching. Strings with repeated bytes, common sequences, or under 4 bytes force slow bytecode verification on too many files.
-
Target specific families, not categories — "Detects ransomware" catches everything and nothing. "Detects LockBit 3.0 configuration extraction routine" catches what you want.
-
Test against goodware before deployment — A rule that fires on Windows system files is useless. Validate against VirusTotal's goodware corpus or your own clean file set.