yara(1)

💖 yara(1) — bestie edition 💖

okay so you found your way to the General Commands Manual page for yara, and honestly? iconic of you. This is the whole thing, top to bottom, no skips, no cap. Let's get into it. 🦋

---

✨ NAME ✨

yara</p紫色> — find files matching patterns and rules written in a special-purpose language. That's the whole vibe. 🔍

---

✨ SYNOPSIS ✨

yara [OPTION]... [NAMESPACE:]RULES_FILE... FILE | DIR | PID

look at that. gorgeous. we love a one-liner. 💅

---

✨ DESCRIPTION ✨

So here's the tea, bestie: yara scans the given FILE, all files contained in directory DIR, or the process identified by PID, looking for matches of patterns and rules provided in a special-purpose language. The rules get read from one or more RULES_FILE. 🎀

The options to yara(1) are:

• --atom-quality-table — Path to a file with the atom quality table. 🗂️
• -C, --compiled-rules — RULES_FILE contains rules already compiled with yarac. (pre-chewed, love that for us)
• -c, --count — Print number of matches only. Just the number. nothing else. minimalism slay. 🔢
• -d, --define=identifier=value — Define an external variable. This option can be used multiple times. 🔁
• --fail-on-warnings — Treat warnings as errors. Has no effect if used with --no-warnings. (not me noticing they cancel each other out 💀)
• -f, --fast-scan — Speeds up scanning by searching only for the first occurrence of each pattern. zoom zoom. 🏎️
• -i identifier, --identifier=identifier — Print rules named identifier and ignore the rest. This option can be used multiple times. 🎯
• --max-process-memory-chunk=size — While scanning process memory read data in chunks of the given size in bytes. 🧩
• -l number, --max-rules=number — Abort scanning after a number of rules matched. ✋
• --max-strings-per-rule=number — Set maximum number of strings per rule (default=10000). 📏
• -x, --module-data=module=file — Pass file's content as extra data to module. This option can be used multiple times. 📦
• -n, --negate — Print rules that doesn't apply (negate). the opposite girlies 🫶
• -w, --no-warnings — Disable warnings. 🤫
• -m, --print-meta — Print metadata associated to the rule. 🏷️
• -D, --print-module-data — Print module data. 📊
• -M, --module-names — show module names. 📛
• -e, --print-namespace — Print namespace associated to the rule. 🌐
• -S, --print-stats — Print rules' statistics. 📈
• -s, --print-strings — Print strings found in the file. 🧵
• -L, --print-string-length — Print length of strings found in the file. 📐
• -X, --print-xor-key — Print xor key of matched strings. 🔐
• -g, --print-tags — Print the tags associated to the rule. 🏷️
• -r, --recursive — Scan files in directories recursively. It follows symlinks. 👀 (yes, it follows symlinks, be normal about it)
• --scan-list — Scan files listed in FILE, one per line. 📝
• -z size, --skip-larger=size — Skip files larger than the given size in bytes when scanning a directory. 🚫
• -k slots, --stack-size=slots — Set maximum stack size to the specified number of slots. 🥞
• --strict-escape — Print warnings if rules contain ambiguous escape statements. ⚠️
• -t tag, --tag=tag — Print rules tagged as tag and ignore the rest. This option can be used multiple times. 🔖
• -p number, --threads=number — Use the specified number of threads to scan a directory. 🧵✨
• -a seconds, --timeout=seconds — Abort scanning after a number of seconds has elapsed. ⏰
• -v, --version — Show version information. 🏆

---

🌈 EXAMPLES 🌈

these are the moments. the little showcases. study them, bestie. 🎀

1. 🍓

$ yara /foo/bar/rules .

Apply rules on /foo/bar/rules to all files on current directory. Subdirectories are not scanned. (just the top layer, no digging 🕳️)

---

2. 🦋

$ yara -t Packer -t Compiler /foo/bar/rules bazfile

Apply rules on /foo/bar/rules to bazfile. Only reports rules tagged as Packer or Compiler. ✨

---

3. 💅

$ cat /foo/bar/rules | yara -r /foo

Scan all files in the /foo directory and its subdirectories. Rules are read from standard input. pipe girlies rise up 🫶

---

4. 👑

$ yara -d mybool=true -d myint=5 -d mystring="my string" /foo/bar/rules bazfile

Defines three external variables mybool myint and mystring. three of them. all at once. multitasking icon. 💖

---

5. 🧚

$ yara -x cuckoo=cuckoo_json_report /foo/bar/rules bazfile

Apply rules on /foo/bar/rules to bazfile while passing the content of cuckoo_json_report to the cuckoo module. 🐦

---

✨ AUTHOR ✨

Victor M. Alvarez <plusvic@gmail.com>;<vmalvarez@virustotal.com> — the actual legend behind all of this. 🌟

---

and that's the whole page, bestie!! written by Victor M. Alvarez, dated September 22, 2008, living in section yara(1) of the manual, forever and always. mwah. 💋✨