YARA

For other uses, see Yara (disambiguation).

YARA
Designed by	Victor Alvarez
First appeared	2013
Stable release	4.5.8  / 28 July 2026 (28 July 2026)
Filename extensions	.yara
Website	virustotal.github.io/yara

YARA is a tool primarily used in malware research and detection.

It provides a rule-based approach to create descriptions of malware families based on regular expression, textual or binary patterns. A description is essentially a YARA rule name, where these rules consist of sets of strings and a Boolean expression.

Analysts write YARA rules to capture the DNA of malware families, persistent elements like code fragments, configuration strings, and structural patterns expressed as text, hex sequences, or regex with Boolean logic. This signature-based detection survives file mutations that defeat hash matching, enabling identification of variants and related samples across large datasets.

History

YARA was originally developed by Victor Alvarez of VirusTotal and released on GitHub in 2013. The name is an abbreviation of YARA: Another Recursive Acronym or Yet Another Ridiculous Acronym. In 2024, Alvarez announced that YARA would be superseded by a rewrite called YARA-X, written in Rust. A first stable version of YARA-X was released in June 2025, marking the passage of the original YARA into maintenance mode.

Design

YARA by default comes with modules to process PE, ELF analysis, as well as support for the open-source Cuckoo sandbox.

See also

• Sigma
• Snort

External links

• yara on GitHub
• YARA documentation