YARA

YARA, created at VirusTotal, lets analysts describe a family of files instead of a single one. A rule lists strings to look for, such as text, hexadecimal byte sequences or regular expressions, and a condition that combines them, for example "the file is a Windows executable and contains at least two of these strings". Because it matches characteristics rather than exact files, one rule can catch many variants of the same malware even when their hashes all differ.

YARA rules are shared widely by researchers and in threat intelligence reports, and many security tools can run them against files, memory or disk images.

Example

rule Suspicious_Loader_Strings
{
    meta:
        description = "Example: loader that downloads a payload with certutil"
    strings:
        $cmd = "certutil -urlcache -f" ascii wide nocase
        $ua  = "Mozilla/4.0 (compatible; MSIE 8.0" ascii
    condition:
        uint16(0) == 0x5A4D and all of them
}

This rule matches Windows executables (which start with the bytes MZ, checked by uint16(0) == 0x5A4D) that contain both strings.

Why it matters for a SOC analyst

When a report publishes YARA rules for a new threat, you can scan your own files and memory for it instead of relying only on indicators like hashes and IP addresses. Writing simple rules is also a great way to understand what makes a malware sample distinctive. Test rules on clean files before deploying them, since overly broad strings create floods of false positives.