skills.rest
marumo333
marumo333COMMUNITY
Explore all skills by this author →
GitHub

yara-rule-authoring

Write, review, and optimize YARA-X detection rules for malware identification.

Updated Apr 5, 2026
Search Tags:#threat hunting#malware detection#IOC#detection rules#YARA#yara-x#signature authoring
One-click install
npx skills add https://github.com/marumo333/atrox --skill yara-rule-authoring-marumo333
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: yara-rule-authoring
Source: https://github.com/marumo333/atrox/tree/main/.claude/skills/trailofbits/plugins/yara-authoring/skills/yara-rule-authoring
Command: npx skills add https://github.com/marumo333/atrox --skill yara-rule-authoring-marumo333

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires yara-x, and includes scripts (resource) and references (resource) components.

What problem does it solve? Writing YARA rules that catch malware without flooding analysts with false positives is hard: poor string selection, unbounded regex, and missing goodware validation cause slow scans and unreliable detections. This Skill guides the authoring of high-quality YARA-X rules with proven conventions, decision trees, and validation tooling. ## Core Features & Use Cases - Rule Authoring Guidance: Covers naming conventions, string selection judgment, condition ordering for short-circuit performance, and required metadata for production rules. - Platform-Specific Detection: Provides patterns for Windows PE, macOS Mach-O, JavaScript/npm supply chain attacks, Chrome extensions (crx module), and Android apps (dex module). - Validation Scripts: Includes an atom analyzer and linter to check string quality, atom extraction efficiency, and YARA-X syntax compliance before deployment. - Use Case: You receive samples of a new LockBit variant. Use this Skill to extract candidate strings with yarGen, filter out generic API names, write a rule with proper metadata and cheap-first conditions, then validate it against a goodware corpus with zero false positives before deploying. ## Quick Start Ask the AI to write a YARA-X rule detecting a specific malware family from your samples, following the naming convention and validating it with the atom analyzer script.

Frequently Asked Questions about yara-rule-authoring

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a YARA rule that avoids false positives?▼

Select strings unique to the malware family such as mutex names, PDB paths, and C2 paths while rejecting API names and common paths. Order conditions with cheap checks like filesize and magic bytes first, then validate against a goodware corpus before deployment.

What makes a good string for YARA rule performance?▼

Good strings are at least 4 bytes with unique consecutive bytes that generate rare atoms for fast Aho-Corasick matching. Avoid repeated bytes like null padding or NOP sleds, short strings under 4 bytes, and unbounded regex patterns that force slow verification.

How do I migrate legacy YARA rules to YARA-X?▼

Run yr check with --relaxed-re-syntax to identify issues, then fix each one: escape literal braces in regex, correct invalid escape sequences, ensure base64 strings have 3+ characters, and replace negative indexing. Verify with yr check without relaxed mode.

Does YARA-X support Chrome extension and Android analysis?▼

Yes, YARA-X v1.5.0+ includes the crx module for Chrome extension permission analysis, and v1.11.0+ adds the dex module for Android class, method, and string detection. The dex module API differs completely from legacy YARA and requires rewriting rules.

Why does my YARA rule match legitimate software?▼

False positives occur when strings are too generic, such as API names, common library strings, or format specifiers found in all executables. Use yr scan -s to identify which string matched, then replace it with a family-specific indicator or add vendor exclusions.

When should I not use YARA for detection?▼

YARA is unsuitable for tasks requiring disassembly, dynamic sandbox analysis, network-based detection, or memory forensics. Simple hash-based detection also does not need YARA; use dedicated tools like Ghidra, Suricata, or Volatility instead.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

performing-malware-ioc-extraction

Extract indicators of compromise from malware samples using static analysis, YARA scanning, and STIX 2.1 formatting.

Community
Advanced
xalgordxalgord
954

implementing-alert-fatigue-reduction

Reduces SOC alert fatigue by tuning detection rules and implementing risk-based alerting in Splunk ES.

Community
Advanced
xalgordxalgord
954

analyzing-command-and-control-communication

Analyzes malware C2 protocols, beacon patterns, and infrastructure to build detection signatures.

Community
Advanced
xalgordxalgord
954

detecting-network-scanning-with-ids-signatures

Detect network reconnaissance and port scanning using Suricata and Snort IDS signatures.

Community
Intermediate