awesome-yara
YARA library
A curated collection of YARA rules and tools for malware analysis and threat detection.
A curated list of awesome YARA rules, tools, and people.
4k stars
175 watching
495 forks
last commit: almost 2 years agoLinked from 9 awesome lists
awesomeawesome-listawesome-yaraiocmalware-analysismalware-detectionmalware-researchmalware-rulesthreat-huntingyarayara-manageryara-rulesyara-scanneryara-signatures
Awesome YARA / Guides | |||
| Yara Performance Guidelines | 126 | over 3 years ago | |
| YARA-Style-Guide | 39 | over 2 years ago | |
Awesome YARA / Rules | |||
| AlienVault Labs Rules | 515 | almost 5 years ago | |
Awesome YARA / Rules / AlienVault Labs Rules | |||
| AlienVault Labs | Collection of tools, signatures, and rules from the researchers at . Search the repo for .yar and .yara extensions to find about two dozen rules ranging from APT detection to generic sandbox / VM detection. Last updated in January of 2016 | ||
Awesome YARA / Rules | |||
| anyrun rules | 15 | almost 2 years ago | |
| Apple OSX | |||
| bartblaze YARA rules | 336 | almost 2 years ago | |
| BinaryAlert YARA Rules | 1,415 | almost 3 years ago | |
| Burp YARA Rules | 44 | over 4 years ago | |
| BinSequencer | 74 | over 4 years ago | |
| CAPE Rules | 2,043 | almost 2 years ago | |
| CDI Rules | 19 | about 3 years ago | |
Awesome YARA / Rules / CDI Rules | |||
| CyberDefenses | Collection of YARA rules released by for public use. Built from information in intelligence profiles, dossiers and file work | ||
Awesome YARA / Rules | |||
| Citizen Lab Malware Signatures | 134 | almost 10 years ago | |
| ConventionEngine Rules | 37 | over 3 years ago | |
| Deadbits Rules | 43 | almost 3 years ago | |
Awesome YARA / Rules / Deadbits Rules | |||
| Adam Swanda | A collection of YARA rules made public by , Splunk's Principal Threat Intel. Analyst, from his own recent malware research | ||
Awesome YARA / Rules | |||
| Delivr.to Detections | 63 | almost 2 years ago | |
| Didier Stevens Rules | 2,051 | almost 2 years ago | |
Awesome YARA / Rules / Didier Stevens Rules | |||
| NVISO Labs Blog | Collection of rules from Didier Stevens, author of a suite of tools for inspecting OLE/RTF/PDF. Didier's rules are worth scrutinizing and are generally written purposed towards hunting. New rules are frequently announced through the | ||
Awesome YARA / Rules | |||
| Ditekshen Rules | 213 | almost 2 years ago | |
| Elastic Security YARA Rules | 1,074 | almost 2 years ago | |
| ESET IOCs | 1,698 | almost 2 years ago | |
Awesome YARA / Rules / ESET IOCs | |||
| ESET WeLiveSecurity Blog | Collection of YARA and Snort rules from IOCs collected by ESET researchers. There's about a dozen YARA Rules to glean from in this repo, search for file extension .yar. This repository is seemingly updated on a roughly monthly interval. New IOCs are often mentioned on the | ||
Awesome YARA / Rules | |||
| Fidelis Rules | |||
| Filescan.io Rules | 9 | almost 2 years ago | ✨ |
| FireEye | 2,652 | over 2 years ago | |
| Florian Roth Rules | 2,509 | almost 2 years ago | |
| Florian Roth's IDDQD Rule | |||
| f0wl yara_rules | 10 | over 4 years ago | |
Awesome YARA / Rules / f0wl yara_rules | |||
| https://dissectingmalwa.re/ | A collection of Yara rules from blog posts | ||
Awesome YARA / Rules | |||
| Frank Boldewin's Rules | 62 | over 3 years ago | |
Awesome YARA / Rules / Frank Boldewin's Rules | |||
| @r3c0nst | A collection of YARA Rules from | ||
Awesome YARA / Rules | |||
| FSF Rules | 290 | about 5 years ago | |
| GoDaddy ProcFilter Rules | 84 | about 9 years ago | |
| Google Cloud Threat Intelligence(GCTI) Rules | 533 | almost 3 years ago | |
| h3x2b Rules | 23 | about 2 years ago | |
| HydraDragonAntivirus | 41 | almost 2 years ago | |
| Icewater Rules | 382 | over 7 years ago | |
| imp0rtp3's Rules | 18 | almost 5 years ago | |
| Intezer Rules | 126 | almost 5 years ago | |
| InQuest Rules | 368 | over 4 years ago | |
Awesome YARA / Rules / InQuest Rules | |||
| InQuest Blog | YARA rules published by InQuest researchers mostly geared towards threat hunting on Virus Total. Rules are updated as new samples are collected and novel pivots are discovered. The will often discuss new findings | ||
Awesome YARA / Rules | |||
| jeFF0Falltrades Rules | 29 | about 2 years ago | |
| kevthehermit Rules | 52 | over 10 years ago | |
| Loginsoft Rules | |||
| lw-yara | 102 | over 5 years ago | |
| ndaal_YARA_passwords_default | |||
| ndaal_YARA_passwords_weak | |||
| NCC Group Rules | 475 | almost 5 years ago | |
| MalGamy's YARA_Rules | 64 | over 3 years ago | |
| Malice.IO YARA Plugin Rules | 30 | about 7 years ago | |
| Malpedia Auto Generated Rules | |||
| Malpedia Auto Generated Rules Repo | 116 | almost 2 years ago | |
| McAfee Advanced Threat Research IOCs | 79 | about 5 years ago | |
| McAfee Advanced Threat Research Yara-Rules | 573 | almost 3 years ago | |
| mikesxrs YARA Rules Collection | 334 | over 2 years ago | |
| Public YARA Rules | 11 | over 7 years ago | |
| QuickSand Lite Rules | 126 | almost 3 years ago | |
| Rapid7-Labs | 54 | almost 2 years ago | |
| Rastrea2r | 236 | about 5 years ago | |
| ReversingLabs YARA Rules | 776 | almost 2 years ago | |
| Securitymagic's YARA Rules | 11 | almost 3 years ago | |
| Sophos AI YaraML Rules | 214 | about 3 years ago | |
| SpiderLabs Rules | 245 | about 10 years ago | |
| StrangeRealIntel's Daily IOCs | 312 | almost 3 years ago | |
| t4d's PhishingKit-Yara-Rules | 207 | almost 2 years ago | |
| Telekom Security Malare Analysis Repository | 110 | almost 3 years ago | |
| Tenable Rules | 60 | almost 4 years ago | |
| ThreatHunting-Keywords-yara-rules | 90 | almost 2 years ago | |
| TjadaNel Rules | 9 | over 7 years ago | |
| VectraThreatLab Rules | 19 | almost 11 years ago | |
| Volexity - Threat-Intel | 342 | almost 2 years ago | |
| x64dbg Signatures | 86 | over 7 years ago | |
| YAIDS | 22 | almost 4 years ago | |
| YARA-FORENSICS | 135 | about 6 years ago | |
| YARA Forge | |||
| yara4pentesters | 125 | over 8 years ago | |
| YaraRules Project Official Repo | 4,215 | over 2 years ago | |
| Yara-Unprotect | 25 | almost 6 years ago | |
Awesome YARA / Rules / Yara-Unprotect | |||
| Unprotect Project | |||
Awesome YARA / Tools | |||
| AirBnB BinaryAlert | 1,415 | almost 3 years ago | |
| alterix | 15 | about 2 years ago | |
| androguard-yara | 6 | almost 11 years ago | |
| a-ray-grass | 14 | about 4 years ago | |
Awesome YARA / Tools / a-ray-grass | |||
| hashlookup.io | YARA module that provides support for bloom filters in yara. In the context of , it allows to quickly discard known files before any further analysis | ||
Awesome YARA / Tools | |||
| Arya- The Reverse YARA | 242 | over 3 years ago | |
| Audit Node Modules With YARA Rules | 20 | over 5 years ago | |
| AutoYara | 61 | over 5 years ago | |
| base64_substring | 41 | about 8 years ago | |
| bincapz | 468 | almost 2 years ago | |
| CAPE: Config And Payload Extraction | 2,043 | almost 2 years ago | |
| CCCS-Yara | 100 | about 2 years ago | |
| clara | 32 | over 2 years ago | |
| Cloudina Security Hawk | 23 | about 2 years ago | |
| CrowdStrike Feed Management System | 129 | almost 8 years ago | |
| CSE-CST AssemblyLine | |||
Awesome YARA / Tools / CSE-CST AssemblyLine | |||
| AssemblyLine | The Canadian Communications Security Establishment (CSE) open sourced , a platform for analyzing malicious files. The component linked here provides an interface to YARA | ||
Awesome YARA / Tools | |||
| decompressingyara | 7 | over 3 years ago | |
| dnYara | 38 | about 3 years ago | |
| ELAT | 29 | almost 10 years ago | |
| Emerson File Scanning Framework (FSF) | 290 | about 5 years ago | |
| ExchangeFilter | 20 | about 5 years ago | |
| factual-rules-generator | 76 | over 4 years ago | |
| Fadavvi YARA collection script | 26 | about 3 years ago | |
| FARA | 49 | over 2 years ago | |
| Fastfinder | 234 | over 4 years ago | |
| findcrypt-yara | 1,376 | almost 2 years ago | and |
| Fibratus | |||
Awesome YARA / Tools / Fibratus | |||
| support for YARA | A modern tool for Windows kernel exploration and observability with a focus on security and | ||
Awesome YARA / Tools | |||
| Fnord | 297 | over 4 years ago | |
| GoDaddy ProcFilter | 396 | over 6 years ago | |
| GhidraYara | 1 | almost 2 years ago | A Ghidra extension providing direct integration of YARA through an analyzer, as well as rule generation from code listings and management in the Ghidra UI. Supports an extensive library of cryptographic constants, CRC tables, etc |
| go-yara | 361 | about 2 years ago | |
| halogen | 208 | over 4 years ago | |
| Hyara | 224 | almost 2 years ago | |
| IDA_scripts | 12 | almost 9 years ago | |
| ida_yara | 22 | about 8 years ago | |
| ida-yara-processor | 29 | over 7 years ago | |
| InQuest ThreatKB | 96 | over 2 years ago | |
| iocextract | 513 | about 2 years ago | |
| Invoke-Yara | |||
| java2yara | 3 | over 4 years ago | |
| KLara | 698 | about 2 years ago | |
| Laika BOSS | 743 | almost 2 years ago | |
Awesome YARA / Tools / Laika BOSS | |||
| Whitepaper | 743 | almost 2 years ago | |
Awesome YARA / Tools | |||
| libyara.NET | 52 | about 2 years ago | |
| Malcat | |||
| MalConfScan | 483 | almost 3 years ago | |
| malscan | 12 | over 8 years ago | |
| Manalyzer Yara Validator | |||
| MISP Threat Sharing | 5,435 | almost 2 years ago | |
| MITRE MultiScanner | 618 | almost 7 years ago | |
| mkYARA | 205 | almost 5 years ago | |
| mquery | 417 | almost 2 years ago | |
| ndaal YARA ruleset checker | |||
Awesome YARA / Tools / Nextron Systems OSS and Commercial Tools (Florian Roth: @Neo23x0) | |||
| Loki | 3,419 | almost 2 years ago | IOC and YARA rule scanner implemented in Python. Open source and free |
| THOR Lite | IOC and YARA rule scanner implemented in Go. Closed source, free, but registration required | ||
Awesome YARA / Tools | |||
| node-yara | 13 | over 5 years ago | |
| ocaml-yara | 5 | about 2 years ago | |
| OCYara | 40 | almost 8 years ago | |
| osquery | |||
| PasteHunter | 1,069 | over 2 years ago | |
| plast | 17 | about 6 years ago | |
| plyara | 175 | almost 2 years ago | |
| Polichombr | 376 | over 7 years ago | |
| PwC Cyber Threat Operations rtfsig | 29 | over 2 years ago | |
| VirusTotalTools | 35 | over 8 years ago | |
| shotgunyara | 9 | about 4 years ago | |
| spyre | 164 | almost 2 years ago | |
| static_file_analysis | 49 | about 3 years ago | |
| stoQ | 395 | about 4 years ago | |
| Strelka | 886 | almost 2 years ago | |
| Sysmon EDR | 218 | over 5 years ago | |
| SwishDbgExt | 373 | almost 8 years ago | |
| ThreatIngestor | 836 | over 2 years ago | |
| UXProtect | |||
| VTCodeSimilarity-YaraGen | 96 | almost 6 years ago | |
Awesome YARA / Tools / VTCodeSimilarity-YaraGen | |||
| @arieljt | Yara rule generator using VirusTotal code similarity feature written by | ||
Awesome YARA / Tools | |||
| Vxsig | 261 | almost 2 years ago | |
| yabin | 158 | about 4 years ago | |
| yaml2yara | 22 | over 6 years ago | |
| YARA-CI | |||
| yaradbg-backend | 24 | over 2 years ago | |
| yaradbg-frontend | 37 | over 2 years ago | |
| yara-endpoint | 104 | over 8 years ago | |
| YaraFileCheckerLib | 2 | over 4 years ago | |
| YaraGenerator | 332 | over 10 years ago | |
| YaraGen | 35 | about 9 years ago | and |
| YaraGuardian | 191 | about 8 years ago | |
| YaraHunter | 1,275 | almost 2 years ago | |
| yara-java | 2 | almost 2 years ago | |
Awesome YARA / Tools / yara-java | |||
| old bindings | 23 | over 2 years ago | Java bindings for YARA (Subreption fork, maintained as of 2024, ) |
Awesome YARA / Tools | |||
| yaralyzer | 109 | almost 2 years ago | |
| yaramail | |||
| yaraMail | 28 | almost 7 years ago | |
| Yara Malware Quick menu scanner | 35 | over 10 years ago | |
| YaraManager | 57 | over 6 years ago | |
| Yaramanager | 65 | over 3 years ago | ( ) |
| yaramod | 120 | almost 2 years ago | |
| yarAnalyzer | 362 | over 3 years ago | |
| yara-ocaml | 11 | almost 7 years ago | |
| yara-parser | 82 | almost 4 years ago | |
| yaraparser | 8 | about 6 years ago | |
| yaraPCAP | 101 | about 13 years ago | |
| yara-procdump-python | 11 | almost 9 years ago | |
| yara-rust | 77 | almost 2 years ago | |
| yara-signator | 157 | about 4 years ago | |
| YARA-sort | 12 | almost 2 years ago | |
Awesome YARA / Tools / YARA-sort | |||
| blog | Aggregate files into collections basd on YARA rules | ||
Awesome YARA / Tools | |||
| Yara Python ICAP Server | 57 | about 5 years ago | |
| yarasafe | 100 | over 6 years ago | |
| Yara-Scanner | 46 | about 10 years ago | |
| yarascanner | 27 | about 9 years ago | |
| YaraSharp | 36 | over 4 years ago | |
| Yara Toolkit | |||
| YaraStation | 36 | over 4 years ago | |
| yara_tools | 72 | over 7 years ago | |
| Yara-Validator | 39 | about 6 years ago | |
| yaraVT | 5 | over 8 years ago | |
| yara_zip_module | 13 | almost 4 years ago | |
| yarg | 25 | about 6 years ago | |
| yarGen | 1,569 | over 2 years ago | |
| Yara Scanner | 18 | almost 4 years ago | |
| Yarasilly2 | 28 | over 2 years ago | |
| yaya | 269 | over 2 years ago | |
| YaYaGen | 62 | almost 8 years ago | |
| Yeti | 1,766 | almost 2 years ago | |
| yextend | 301 | over 4 years ago | |
| yaraZeekAlert | 60 | almost 3 years ago | |
| yaraScanParser | 11 | over 5 years ago | |
Awesome YARA / Tools / yaraScanParser | |||
| Yara Scan Service | Parsing tool for 's JSON output file | ||
Awesome YARA / Tools | |||
| YARI | 88 | almost 2 years ago | |
| YLS | 69 | almost 2 years ago | |
| YMCA | 3 | over 4 years ago | |
| Yobi | 48 | about 5 years ago | |
| statiStrings | 12 | about 5 years ago | |
Awesome YARA / Services | |||
| Hybrid Analysis YARA Search | |||
| InQuest Labs | |||
| Koodous | |||
| MalShare | |||
| MalwareConfig | |||
| YaraEditor (Web) | |||
| YARAify | |||
| Yara Scan Service | |||
Awesome YARA / Syntax Highlighters | |||
| language-yara | 25 | about 5 years ago | Atom: |
| yara-mode | 7 | about 4 years ago | Emacs: |
| GtkSourceView-YARA | 3 | over 6 years ago | GTK-based editors, like gedit and xed: |
| userDefinedLanguages | 606 | almost 2 years ago | Notepad++: |
| YaraSyntax | 19 | almost 4 years ago | Sublime Text: |
| vim-yara | 14 | over 5 years ago | Vim: , |
| vscode-yara | 63 | over 2 years ago | Visual Studio Code: |
Awesome YARA / Videos and Talks | |||
| Finding Evil with YARA | |||
| SAS2018: Finding aliens, star weapons and ponies with YARA | |||
| Costin Raiu - Combining code similarity with Yara to find goodies | |||
| YARA Rule Processing Sessions - Florian Roth | |||
| Upping the APT hunting game: learn the best YARA practices from Kaspersky | |||
| Star-Gazing | Using a Full Galaxy of YARA Methods to Pursue an Apex Actor | By Greg Lesnewich | |||
| Lightweight Binary Similarity - YARA Using PE Features for Quick Wins | 4 | almost 5 years ago | |
| DEF CON 26 - Andrea Marcelli - Looking for the perfect signature an automatic YARA rules | |||
Awesome YARA / Related Awesome Lists | |||
| Crawler | 6,530 | over 2 years ago | |
| CVE PoC | 3,339 | over 4 years ago | |
| Forensics | 4,030 | almost 2 years ago | |
| Hacking | 13,321 | over 2 years ago | |
| HackwithGithub | 86,668 | about 2 years ago | |
| Honeypots | 8,732 | about 2 years ago | |
| Incident-Response | 7,728 | about 2 years ago | |
| Infosec | 5,221 | over 2 years ago | |
| IOCs | 817 | almost 2 years ago | |
| Malware Analysis | 12,073 | over 2 years ago | |
| ML for Cyber Security | 7,311 | about 2 years ago | |
| OSINT | 19,410 | almost 2 years ago | |
| PCAP Tools | 3,143 | over 2 years ago | |
| Pentesting | 22,116 | almost 2 years ago | |
| Reversing | 4,105 | about 3 years ago | |
| Security | 12,563 | about 2 years ago | |
| Static Analysis | 13,429 | almost 2 years ago | |
| Threat Detection | 3,916 | about 2 years ago | |
| Threat Intelligence | 8,211 | about 2 years ago | |
hack-with-github/awesome-hacking
enaqx/awesome-pentest
sbilly/awesome-security
rshipp/awesome-malware-analysis
decalage2/awesome-security-hardening
cugu/awesome-forensics
0x4d31/awesome-threat-detection
0ex/more-awesome
netanmangal/awesome-hacking
virustotal/yara
citizenlab/malware-indicators
zbetcheckin/security_list
sigmahq/sigma
mandiant/capa
k-atc/peid
rust-leipzig/regex-performance
apr4h/cobaltstrikescan
zigrin-security/cakefuzzer
wkentaro/pytorch-fcn
bitwiseshiftleft/sjcl
arxsys/dff