yara-rule-authoring

Malicious tool definition detected

Tool: SKILL.md [1/4] Description: --- name: yara-rule-authoring description: > Guides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules.

Tool: SKILL.md [2/4] Description: rule to catch all variants" | Causes FP floods. Target specific families. | | "I'll make it more specific if we get FPs" | Write tight rules upfront. FPs burn trust. | | "This hex pattern is unique" | Unique in one sample ≠ unique across malware ecosystem.

Tool: SKILL.md [3/4] Description: broad. **Modifier discipline:** - **Never use `nocase` or `wide` speculatively** — only when you have confirmed evidence the case/encoding varies in samples - `nocase` doubles atom generation; `wide` doubles string matching — both have real costs - "If you don't have a clear reason for using those modifiers, don't do it" — Kaspersky Applied YARA **Regex anchoring:** - Regex without a 4+ byte literal substring **evaluates at every file offset** — catastrophic per

Tool: SKILL.md [4/4] Description: < 10MB` first | | Short strings | `"abc"` (3 bytes) | `"abcdef"` (4+ bytes) | | Unescaped braces (YARA-X) | `/config{key}/` | `/config\{key\}/` | ## Performance Optimization **Quick wins:** Put `filesize` first, avoid `nocase`, bounded regex `{1,100}`, prefer hex over regex.

Malicious tool definition detected

Malicious tool definition detected

Tool: examples/MAL_NPM_SupplyChain_Jan25.yar Description: /* Real YARA Rules: npm Supply Chain Attack Detection These rules detect patterns from documented npm supply chain attacks.

Malicious tool definition detected

Tool: examples/MAL_Win_Remcos_Jan25.yar Description: /* Real YARA Rule: Windows Remcos RAT Detection This rule is adapted from Elastic Security's production rules for detecting Remcos RAT.

Malicious tool definition detected

Tool: examples/SUSP_CRX_SuspiciousPermissions.yar Description: /* Example YARA-X Rule: Chrome Extension Analysis This rule demonstrates the YARA-X crx module for detecting suspicious Chrome extensions.

Malicious tool definition detected

Tool: examples/SUSP_JS_Obfuscation_Jan25.yar Description: /* Real YARA Rules: JavaScript Obfuscation Detection These rules detect common JavaScript obfuscation patterns used by malware.

Malicious tool definition detected

Tool: references/crx-module.md Description: # YARA-X CRX Module Reference The `crx` module enables analysis of Chrome extension packages (CRX files).

Malicious tool definition detected

Tool: references/dex-module.md [1/2] Description: # YARA-X DEX Module Reference The `dex` module enables analysis of Android Dalvik Executable (DEX) files.

Tool: references/dex-module.md [2/2] Description: ) and // Location tracking dex.contains_string("android.permission.ACCESS_FINE_LOCATION") and // Command channel ( dex.contains_string("socket") or dex.contains_class("Ljava/net/Socket;") ) and // File exfiltration ( dex.contains_method("getExternalStorage") or dex.contains_string("/sdcard/") ) } ``` ## Best Practices 1.

Malicious tool definition detected

Tool: references/performance.md [1/2] Description: # YARA-X Performance Guidelines Understanding how YARA-X works internally helps you write rules that scan fast. > **YARA-X Performance:** YARA-X is 5-10x faster than legacy YARA for regex-heavy rules due to its Rust-based regex engine.

Tool: references/performance.md [2/2]

Malicious tool definition detected

Tool: references/strings.md [1/2] Description: # YARA-X String Selection Choosing the right strings is the most critical decision in YARA rule writing. > **YARA-X Note:** YARA-X enforces stricter validation on strings.

Tool: references/strings.md [2/2] Description: = "Global\\MyMutex" $config = { 43 4F 4E 46 49 47 } // C2 indicators (any one) $c2_1 = "/api/beacon" $c2_2 = "/check_in" condition: all of ($mutex, $config) and any of ($c2_*) ``` ### False Positive Exclusions ```yara strings: $malware = "SuspiciousString" $fp_legitimate = "Legitimate Vendor Inc" condition: $malware and not $fp_legitimate ``` ## Using yarGen Effectively yarGen extracts candidate strings, but you must validate: ```bash python yarGen.

Malicious tool definition detected

Tool: references/style-guide.md [1/2]

Tool: references/style-guide.md [2/2]

Malicious tool definition detected

Tool: references/testing.md [1/2] Description: # YARA-X Rule Testing Testing is non-negotiable. Untested rules cause alert fatigue (false positives) or missed detections (false negatives).

Tool: references/testing.md [2/2] Description: demonstrate Apple's production patterns for macOS malware detection.

Malicious tool definition detected

Tool: scripts/atom_analyzer.py [1/2] Description: # /// script # requires-python = ">=3.11" # dependencies = ["yara-x>=0.10.0"] # /// """YARA-X string atom quality analyzer.

Tool: scripts/atom_analyzer.py [2/2] Description: start while pos < len(content) and brace_count > 0: if content[pos] == "{": brace_count += 1 elif content[pos] == "}": brace_count -= 1 pos += 1 rule_content = content[start : pos - 1] strings_match = re.search(r"strings\s*:\s*(.*?)(?=condition\s*:|$)", rule_content, re.DOTALL) if not strings_match: return strings strings_section = strings_match.group(1) # Parse text strings: $name = "value" modifiers for match in re.finditer(r'(\$\w+)\s*=\s*"([^

Malicious tool definition detected

Tool: scripts/pyproject.toml Description: [project] name = "yara-x-authoring-scripts" version = "2.0.0" description = "YARA-X rule authoring utilities" requires-python = ">=3.11" dependencies = ["yara-x>=0.10.0"] [tool.ruff] target-version = "py311" line-length = 100 [tool.ruff.lint]

Malicious tool definition detected

Tool: scripts/yara_lint.py [1/2] Description: # /// script # requires-python = ">=3.11" # dependencies = ["yara-x>=0.10.0"] # /// """YARA-X rule linter for style, metadata, compatibility, and common anti-patterns.

Tool: scripts/yara_lint.py [2/2] Description: unescaped { in regex (YARA-X strict mode) if re.search(r"(?<!\\)\{(?![0-9])", string_value): yield Issue( rule=rule_name, severity="error", code="E007", message=f"Regex {string_id} has unescaped '{{'; " "YARA-X requires escaping as '\\{{'", ) # Check for unbounded regex if re.search(r"(?<!\\)\.\*(?!\?)", string_value) or re.search( r"(?<!\\)\.\+(?!\?)", string_value ): yield Issue( rule=rule_name, severity="warning", code="W008", message=f"Regex {str

Malicious tool definition detected

Tool: workflows/rule-development.md [1/2] Description: # YARA Rule Development Workflow This guide walks through the complete process of developing a production-quality YARA-X rule, from sample collection to deployment.

Tool: workflows/rule-development.md [2/2] Description: cost:** 1.