What is yara rules:
It is a tool used to identify patterns within files, often for detecting potentially malicious content.
How to install:
sudo apt install yara -y
How to write:
Create a file named my_first_rule.yar (or any other preferred name with a .yar extension) and enter the following text. Multiple rules can be included in a single file.
rule rule_one
{
meta:
description = "What the rule can do"
author = "Your name"
strings:
$v1 = "Pattern I'm looking for"
$v2 = "Another pattern I'm looking for"
condition:
$v1 or $v2
}
Save and exit from the file.
How to run:
yara yara_rule_file.yar the_file_you_want_to_search example: yara my_first_rule.yar myfile.sh
Output:
If a match is found in the file named myfile.sh, it will display the rule name along with the file name, as shown below:
rule_one myfile.sh
Collection:
https://github.com/Yara-Rules/rules
Enjoy YARA!
Thanks for reading the post. If you enjoyed the post, please share it with your network and let me know your thoughts in the comments.
About the Author: Imtiaz is working in a financial organization in Bangladesh and having experience in system, network and security administration. Feel free to contact with him on LinkedIn or Twitter.