skills.rest
ayehiaa
ayehiaaCOMMUNITY
Explore all skills by this author →
GitHub

yara-rule-authoring

Author YARA-X detection rules for malware identification with validation via yr check and yr fmt.

Updated May 2, 2026
Search Tags:#false-positives#malware-analysis#detection-rules#yara-x#rule-optimization#crx-module#dex-module
One-click install
npx skills add https://github.com/ayehiaa/my-travel-assistant --skill yara-rule-authoring-ayehiaa
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: yara-rule-authoring
Source: https://github.com/ayehiaa/my-travel-assistant/tree/main/.agents/skills/yara-rule-authoring
Command: npx skills add https://github.com/ayehiaa/my-travel-assistant --skill yara-rule-authoring-ayehiaa

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires yara-x, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps you author YARA-X detection rules that accurately identify malware while avoiding false positives and slow scans caused by low-quality strings, weak conditions, or unbounded patterns.

Core Features & Use Cases

  • High-signal rule design: choose strong indicators (atoms), target specific families, and structure conditions for short-circuit performance.
  • YARA-X correctness and migration guidance: address stricter YARA-X validation, including regex escaping and legacy-to-modern compatibility.
  • Platform-aware detection strategies: tailor checks for PE, Mach-O, JavaScript, npm packages, Office docs, Chrome extensions (crx module), and Android apps (dex module).
  • Quality assurance workflow: use validate/format/tooling guidance (yr check/yr fmt and module inspection) plus guidance for false-positive debugging.

Quick Start

Use this skill to review and improve an existing YARA-X rule so it matches the intended malware samples while producing minimal false positives and runs efficiently.

Frequently Asked Questions about yara-rule-authoring

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write YARA-X rules that minimize false positives in malware detection?▼

To write YARA-X rules with minimal false positives, select high-quality string atoms and structure conditions with short-circuit performance ordering. This approach ensures rules accurately target specific malware families while avoiding weak indicators that trigger false alerts.

What is the best way to migrate legacy YARA rules to YARA-X?▼

Migrating legacy YARA rules to YARA-X requires addressing stricter validation, including proper regex escaping and syntax compatibility. The migration process ensures existing detection signatures pass yara-x validation tooling like yr check and yr fmt.

How do I write YARA-X detection rules for Chrome CRX and Android DEX files?▼

Writing YARA-X detection rules for Chrome CRX and Android DEX files requires correct usage of the crx and dex modules. Platform-aware detection strategies tailor checks specifically for these formats to identify malware accurately.

Does YARA-X validation tooling help debug slow scans caused by unbounded regex?▼

YARA-X validation tooling like yr check and yr fmt helps debug slow scans by enforcing bounded and properly escaped regex patterns. This validation ensures conditions are ordered cheap-to-expensive to prevent performance bottlenecks during malware scanning.

Why does my YARA-X rule fail validation when targeting PE or Mach-O binaries?▼

YARA-X rule validation fails when targeting PE or Mach-O binaries due to stricter validation requirements for regex escaping and atom quality. Ensuring strong string indicators and properly bounded patterns resolves these validation errors during malware identification.

Related Skills

Explore More Software Engineering Skills→
balsm-healthbalsm-health
2

extracting-iocs-from-malware-samples

Extract file hashes, network indicators, and host artifacts from malware samples.

Official
Advanced
Ramprasad4121Ramprasad4121
1

yara-rule-authoring

Guide YARA-X detection rule authoring for malware identification.

Community
Advanced
keremtoker468-dotcomkeremtoker468-dotcom

yara-rule-authoring

Guide YARA-X detection rule authoring for malware identification.

Community
Advanced
manuelbrandner85manuelbrandner85

yara-rule-authoring

Author and optimize YARA-X detection rules for malware identification.

Community
Advanced