Overview

YARA is the pattern-matching engine that malware researchers, incident responders and detection engineers use to identify and classify malicious files. You describe a malware family — or any suspicious artefact — as a set of textual or binary patterns plus a boolean condition, and YARA reports every file that satisfies the logic. A single rule can combine strings, hexadecimal byte sequences, regular expressions, wildcards and file-structure conditions supplied by modules such as PE, ELF, Mach-O and .NET.

VirusTotal has maintained the project since its beginning (the upstream copyright header reads 2007–2016 The YARA Authors), and the format has become the de facto language of the threat-intelligence industry: vendors, CERTs and independent researchers publish YARA rules much as they publish hashes and IOCs. The current upstream release is 4.5.8 (July 2026). Note that the C implementation is now in maintenance mode — VirusTotal’s active line of development is YARA-X, a Rust rewrite that reached 1.0 in June 2025 and stays rule-compatible with the 4.x series.

Key Features

• Expressive rule language — strings can be plain text (case-sensitive or case-insensitive, ASCII or wide/UTF-16), hexadecimal byte patterns with wildcards (?A 4?) and jumps ([4-6]), or regular expressions. Conditions support boolean operators, match counts, offsets, at, in and for loops over matches.
• Structure-aware modules — built-in modules parse PE, ELF, Mach-O and .NET binaries, evaluate hashes and math, inspect Office and LNK structures, read magic signatures and expose Cuckoo Sandbox report data — so rules can key on imports, sections, entitlements or packer anomalies rather than raw bytes alone.
• Compiled rules for speed — the bundled yarac compiler turns rule sets into binary form (-C), so production scanners skip the parse-and-compile stage on every run; scanning itself is multi-threaded.
• Runs anywhere — a command-line tool (yara), a C library (libyara) for embedding in other products, and yara-python bindings for scripting. Rule sets can also be applied to running processes and to files inside archives with helper tools such as yextend.
• Built for large rule sets — namespaces and tags organise thousands of rules, meta fields carry author, description, threat level and references, and include shares common definitions between files.
• Rule-quality tooling — YARA-CI provides continuous testing of rule repositories, catching mistakes and false positives before a rule reaches production.

Why Use It

YARA gives you a portable, vendor-neutral way to write down what a threat looks like and then apply that description at scale. Rules outlive tooling churn: the same rule set can hunt across a laptop, a mail gateway, a sandbox appliance, a network sensor or a memory image, and it can be shared with a CERT, a customer or the wider community without exposing an internal detection stack. Because rules are readable text, they are reviewed, versioned and unit-tested like code — which is exactly what detection-as-code workflows expect.

Use Cases

• Malware classification and triage — label incoming samples by family, campaign or toolkit, the task YARA was written for at VirusTotal.
• Threat hunting and incident response — sweep endpoints, file shares and forensic images for the artefacts a specific intrusion leaves behind.
• Memory and process scanning — catch in-memory-only implants and injected code that never touches disk.
• Detection engineering and CI — validate and test rule repositories automatically, then ship compiled rules to sensors.
• Embedded in platforms — the rule format powers detections in products from VirusTotal, Elastic, Corelight, Cuckoo Sandbox, InQuest, osquery and Nextron, among many others listed by the project.

Platforms

YARA is multi-platform C and runs on Linux, Windows, macOS and BSD, with packages in Debian/Ubuntu, Fedora, Arch, Homebrew, Chocolatey and vcpkg, plus pip install yara-python for the Python bindings. YARA-X ships pre-built binaries for the same platforms along with Rust, Go and Python APIs.

Licence

Free and open source. YARA is released under the BSD 3-Clause licence: the upstream COPYING file permits redistribution and use in source and binary forms provided the copyright notice and disclaimer are retained, and it forbids using the project’s name to endorse derived products. Copyright is held by The YARA Authors, whose AUTHORS file lists organisations including Avast and Google Inc. YARA-X carries the same BSD 3-Clause licence.

Alternatives

• ClamAV — signature-based antivirus scanning of files, mail and web traffic
• chkrootkit — rootkit signature and integrity scanning for Unix systems
• Nuclei — template-driven scanning for network, web and cloud targets
• Browse more security and privacy tooling in the directory