awesome-yara

Collection of tools, signatures, and rules from the researchers at . Search the repo for .yar and .yara extensions to find about two dozen rules ranging from APT detection to generic sandbox / VM detection. Last updated in January of 2016

Collection of YARA rules released by for public use. Built from information in intelligence profiles, dossiers and file work

A collection of YARA rules made public by , Splunk's Principal Threat Intel. Analyst, from his own recent malware research

Collection of rules from Didier Stevens, author of a suite of tools for inspecting OLE/RTF/PDF. Didier's rules are worth scrutinizing and are generally written purposed towards hunting. New rules are frequently announced through the

Collection of YARA and Snort rules from IOCs collected by ESET researchers. There's about a dozen YARA Rules to glean from in this repo, search for file extension .yar. This repository is seemingly updated on a roughly monthly interval. New IOCs are often mentioned on the

Filescan.io Rules

✨

A collection of Yara rules from blog posts

A collection of YARA Rules from

YARA rules published by InQuest researchers mostly geared towards threat hunting on Virus Total. Rules are updated as new samples are collected and novel pivots are discovered. The will often discuss new findings

YARA module that provides support for bloom filters in yara. In the context of , it allows to quickly discard known files before any further analysis

The Canadian Communications Security Establishment (CSE) open sourced , a platform for analyzing malicious files. The component linked here provides an interface to YARA

findcrypt-yara

and

A modern tool for Windows kernel exploration and observability with a focus on security and

GhidraYara

A Ghidra extension providing direct integration of YARA through an analyzer, as well as rule generation from code listings and management in the Ghidra UI. Supports an extensive library of cryptographic constants, CRC tables, etc

Loki

IOC and YARA rule scanner implemented in Python. Open source and free

IOC and YARA rule scanner implemented in Go. Closed source, free, but registration required

Yara rule generator using VirusTotal code similarity feature written by

YaraGen

and

old bindings

Java bindings for YARA (Subreption fork, maintained as of 2024, )

Yaramanager

( )

Aggregate files into collections basd on YARA rules

Parsing tool for 's JSON output file

language-yara

Atom:

yara-mode

Emacs:

GtkSourceView-YARA

GTK-based editors, like gedit and xed:

userDefinedLanguages

Notepad++:

YaraSyntax

Sublime Text:

vim-yara

Vim: ,

vscode-yara

Visual Studio Code: