skills.rest
TECH-HY
TECH-HYOFFICIAL
Explore all skills by this author →
GitHub

yara-rule-authoring

Write, validate, and optimize YARA-X detection rules for malware identification.

Updated Mar 22, 2026
Search Tags:#threat hunting#malware detection#signature#ioc#yara#yara-x#rule authoring
One-click install
npx skills add https://github.com/TECH-HY/SKILLS --skill yara-rule-authoring-tech-hy
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: yara-rule-authoring
Source: https://github.com/TECH-HY/SKILLS/tree/main/skills/yara-rule-authoring
Command: npx skills add https://github.com/TECH-HY/SKILLS --skill yara-rule-authoring-tech-hy

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires yara-x, and includes scripts (resource) and references (resource) components.

What problem does it solve? Writing YARA rules that catch malware without flooding analysts with false positives is hard: strings must generate good atoms, conditions must be ordered for performance, and rules must be validated against goodware before deployment. This Skill guides the authoring of high-quality YARA-X detection rules, covering string selection, performance optimization, and migration from legacy YARA. ## Core Features & Use Cases - Rule authoring guidance: Naming conventions, required metadata, string selection decision trees, and condition ordering patterns for PE, Mach-O, JavaScript, npm packages, Office docs, Chrome extensions (crx module), and Android apps (dex module). - Validation scripts: Run yara_lint.py to check style and metadata, and atom_analyzer.py to score string atom quality and flag performance-killing patterns like short strings, repeated bytes, and unbounded regex. - Migration support: Fix common legacy YARA incompatibilities (unescaped braces, invalid escapes, base64 length requirements) using yr check and yr fmt. - Use Case: You receive a new malware family sample. Use this Skill to extract candidate strings with yarGen, filter out API names and common paths, write a rule with proper metadata, validate it with yr check and the linter, and confirm zero matches against a goodware corpus before deployment. ## Quick Start Ask the AI to write a YARA-X rule detecting a specific malware family from your samples, then validate it with the atom analyzer and linter scripts.

Frequently Asked Questions about yara-rule-authoring

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a YARA rule that avoids false positives?▼

Select strings unique to the malware family such as mutex names, PDB paths, and C2 paths, and reject API names, common paths, and format strings. Validate the rule against a goodware corpus like VirusTotal's before deployment; zero matches means it is ready, while three or more matches means finding different indicators.

How to migrate legacy YARA rules to YARA-X?▼

Run yr check --relaxed-re-syntax to identify issues, then fix each one: escape literal braces in regex, correct invalid escape sequences, ensure base64 strings have 3+ characters, and replace negative indexing. Verify with yr check without relaxed mode and format with yr fmt.

What makes a YARA string slow for scanning performance?▼

Strings under 4 bytes, repeated byte patterns like NOP sleds or null bytes, unbounded regex such as .*, and leading wildcards all prevent efficient 4-byte atom extraction. This forces slow bytecode verification on every file instead of fast Aho-Corasick matching.

Does YARA-X support Chrome extension and Android analysis?▼

Yes, YARA-X v1.5.0+ includes the crx module for Chrome extension permission analysis, and v1.11.0+ adds the dex module for Android DEX files with functions like dex.contains_class and dex.contains_method. The dex module API is not compatible with legacy YARA.

Why does my YARA rule match legitimate software?▼

The rule likely uses generic strings like API names, common library references, or framework calls such as fetch or require that appear in legitimate code. Run yr scan -s to see which string matched, then replace it with a family-specific indicator or add exclusions for known vendors.

When should I not use YARA for detection?▼

YARA is not suited for tasks requiring disassembly, dynamic sandbox analysis, network-based detection, or memory forensics. Simple hash-based detection also does not need YARA; use dedicated tools like Ghidra, Suricata, or Volatility for those scenarios.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

performing-malware-ioc-extraction

Extract indicators of compromise from malware samples using static analysis, YARA scanning, and STIX 2.1 formatting.

Community
Advanced
xalgordxalgord
954

implementing-alert-fatigue-reduction

Reduces SOC alert fatigue by tuning detection rules and implementing risk-based alerting in Splunk ES.

Community
Advanced
xalgordxalgord
954

analyzing-command-and-control-communication

Analyzes malware C2 protocols, beacon patterns, and infrastructure to build detection signatures.

Community
Advanced
Liberty91LTDLiberty91LTD
15

malware-analysis

Identify malware samples and extract static and dynamic indicators from reports.

Official
Intermediate