YARA is the name of a tool primarily used in
malware
Malware (a portmanteau for ''malicious software'') is any software intentionally designed to cause disruption to a computer, server, client, or computer network, leak private information, gain unauthorized access to information or systems, depri ...
research and detection.
It provides a rule-based approach to create descriptions of malware families based on
regular expression,
textual
In literary theory, textuality comprises all of the attributes that distinguish the communicative content under analysis as an object of study. It is associated with structuralism and post-structuralism.
Explanation
Textuality is not just ab ...
or
binary patterns. A description is essentially a YARA rule name, where these rules consist of sets of
strings
String or strings may refer to:
*String (structure), a long flexible structure made from threads twisted together, which is used to tie, bind, or hang other objects
Arts, entertainment, and media Films
* ''Strings'' (1991 film), a Canadian anim ...
and a
boolean expression.
History
YARA was originally developed by Victor Alvarez of
VirusTotal
VirusTotal is a website created by the Spanish security company Hispasec Sistemas. Launched in June 2004, it was acquired by Google in September 2012. The company's ownership switched in January 2018 to Chronicle, a subsidiary of Google.
Viru ...
, and released on GitHub in 2013. The name is either an abbreviation of YARA: Another Recursive Acronym, or Yet Another Ridiculous Acronym.
Design
YARA by default comes with modules to process
PE,
ELF analysis, as well as support for the open-source Cuckoo
sandbox
A sandbox is a sandpit, a wide, shallow playground construction to hold sand, often made of wood or plastic.
Sandbox or Sand box may also refer to:
Arts, entertainment, and media
* Sandbox (band), a Canadian rock music group
* Sandbox ( ...
.
See also
*
Sigma
Sigma (; uppercase Σ, lowercase σ, lowercase in word-final position ς; grc-gre, σίγμα) is the eighteenth letter of the Greek alphabet. In the system of Greek numerals, it has a value of 200. In general mathematics, uppercase Σ is used as ...
*
Snort
Snort may refer to:
* Nose-blowing
* Sniffle
* Nasal administration, the inhaling of drugs through the nose
* Snort (software), a package for intrusion detection
* Snort, a map-coloring game
* Insufflation, the act of blowing, breathing, hissing, ...
References
External links
*
YARA documentation
{{malware-stub
Computer forensics