skills.rest
Solizardking
SolizardkingCOMMUNITY
Explore all skills by this author →
Website𝕏@0rdlibraryGitHub

yara-authoring

Write and test YARA rules for malware detection and threat hunting.

1|Updated Aug 5, 2026
Search Tags:#security#scanning#threat hunting#malware detection#detection rules#ioc#yara
One-click install
npx skills add https://github.com/Solizardking/Solana-Robotics-Kit --skill yara-authoring-solizardking
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: yara-authoring
Source: https://github.com/Solizardking/Solana-Robotics-Kit/tree/main/eliza/packages/skills/skills/yara-authoring
Command: npx skills add https://github.com/Solizardking/Solana-Robotics-Kit --skill yara-authoring-solizardking

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Writing effective YARA rules requires knowing the correct syntax for strings, conditions, and modifiers, and mistakes lead to missed detections or false positives. This Skill provides templates, syntax references, and scanning commands so analysts can produce tested detection signatures quickly. ## Core Features & Use Cases - Rule Authoring: Generate YARA rules with proper meta blocks, string definitions (text, hex, regex), and condition logic for detecting malware families and IOCs. - Scanning Workflows: Run yara and yarac commands to scan files, directories, or compiled rule sets against targets. - Use Case: A threat intelligence analyst receives a report on a new malware family and uses this Skill to draft a detection rule with unique strings, magic byte checks, and filesize constraints, then validates it against known samples and clean files. ## Quick Start Write a YARA rule that detects a PE file containing the strings 'evil_c2_domain' and a specific hex pattern, then scan my samples directory with it.

Frequently Asked Questions about yara-authoring

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a YARA rule to detect malware?▼

Define a rule with a meta block, a strings section containing text, hex, or regex patterns, and a condition combining them. Include magic byte checks like uint16(0) == 0x5A4D and filesize limits to narrow scope and reduce false positives.

How to scan files with YARA rules from the command line?▼

Run 'yara rule.yar target_file' for a single file or 'yara -r rules/ /path/to/scan/' for recursive directory scanning. Use 'yarac' to compile rules and 'yara -C compiled.yarc' for faster repeated scanning.

What string modifiers does YARA support?▼

YARA supports ascii and wide for encoding, nocase for case-insensitive matching, fullword for word boundaries, xor for XOR-encoded strings, and base64 for base64-encoded content. Combine modifiers to catch obfuscated malware strings.

When should I not use YARA rules?▼

YARA is not suited for dynamic malware analysis, which requires sandbox environments, or network traffic analysis, which needs Suricata or Snort rules. For static source code analysis, use Semgrep instead.

Why does my YARA rule produce false positives?▼

False positives come from overly broad strings or regex patterns common in legitimate files. Prefer multiple weak indicators combined in the condition, add filesize and magic byte constraints, and test rules against clean files before deployment.

Related Skills

Explore More Software Engineering Skills→
balic-AI-ML-R-D-Resourcesbalic-AI-ML-R-D-Resources

yara-authoring

Write and test YARA rules to detect malware samples and threats.

Official
Intermediate
AxxxxxxaaannAxxxxxxaaann

analyzing-malicious-url-with-urlscan

Submit URLs to URLScan.io and extract phishing and malware indicators.

Community
Advanced
dandyedandye
120

triage-malware

Triage malware hashes with GTI and SIEM enrichment for classification and containment.

Community
Advanced
xalgordxalgord
954

detecting-network-scanning-with-ids-signatures

Detect network reconnaissance and port scanning using Suricata and Snort IDS signatures.

Community
Intermediate