yara-rules-guide

• SKILL.mdcore · 13,493 bytes
• SKILL.mdcore · 13,493 bytes
• SKILL.mdcore · 13,493 bytes

<!-- AUTO-GENERATED by export-skills.py — DO NOT EDIT -->
---
name: yara-rules-guide
description: YARA rule syntax and pattern matching reference for malware detection, threat hunting, and file classification
tags: [detection, security]
---

# YARA Rules Guide

## Overview

YARA is a pattern-matching tool designed to identify and classify malware samples, suspicious files, and other artifacts. Security researchers describe malware families or threat indicators using rules composed of textual patterns, hexadecimal sequences, regular expressions, and boolean conditions. YARA rules are the standard language for file-based threat detection across antivirus engines, sandboxes, threat intelligence platforms, and incident response toolkits.

A YARA rule consists of three main sections: **meta** (descriptive metadata), **strings** (patterns to search for), and **condition** (boolean logic that determines a match). Rules can also import modules (PE, ELF, math, hash) to inspect file structure and properties beyond raw content.