YARA: Complete Guide to Malware Detection, Threat Hunting, and Rule-Based Analysis Using Kali Linux

YARA (“Yet Another Recursive Acronym,” or informally “the pattern matching swiss knife for malware researchers”) is an open-source tool created by Victor Manuel Álvarez (originally at VirusTotal) used to identify and classify malware samples by creating descriptions — called rules — based on textual or binary patterns. Each rule is a set of strings (plain text, hex bytes, or regular expressions) plus a boolean condition that decides whether a file “matches.”

YARA is used for:

• Classifying and naming malware families
• Hunting for malicious files across a filesystem, a memory image, or a network share
• Building detection content for EDR/AV engines
• Triggering automated response (e.g., via ClamAV, THOR, Loki, or custom SOC scripts)
• Scanning running processes and memory dumps for injected code or in-memory-only malware

YARA ships as both a standalone command-line binary (yara) and a Python library (yara-python) for scripting.

Key Concepts

• Rule — a named block containing optional meta, strings, and a mandatory condition.
• Strings — text strings ($a = "cmd.exe"), hex byte patterns ($b = { 6A 40 68 00 30 00 00 }), or regular expressions ($c = /https?:\/\/[a-z]+\.com/).
• Condition — a boolean expression (e.g., $a and $b, all of them, #a > 3) that determines a match.
• Modules — built-in extensions such as pe, elf, math, hash, magic, and cuckoo that expose structured file metadata to conditions.

How to Install

On Kali Linux (already included in most Kali images):

sudo apt update
sudo apt install yara -y

Verify installation:

yara --version

Install the Python bindings (for scripting):

sudo apt install python3-yara -y
# or via pip inside a venv
pip install yara-python --break-system-packages

Build from source (latest version, with all modules):

sudo apt install -y automake libtool make gcc pkg-config \
    libssl-dev libjansson-dev libmagic-dev flex bison
git clone --recursive https://github.com/VirusTotal/yara.git
cd yara
./bootstrap.sh
./configure --enable-cuckoo --enable-magic --enable-dotnet
make
sudo make install
sudo ldconfig

Syntax

yara [OPTIONS] RULES_FILE TARGET
yara [OPTIONS] RULES_FILE PID

Where:

• RULES_FILE — path to a .yar/.yara file, a compiled rules file (-C), or - to read a rule from stdin.
• TARGET — a file, a directory (with -r for recursive), or a running process ID.

Basic rule syntax:

rule RuleName : tag1 tag2
{
    meta:
        author = "analyst"
        description = "detects sample X"
        date = "2026-07-19"

    strings:
        $s1 = "malicious_string" nocase
        $s2 = { E8 ?? ?? ?? ?? 5D C3 }
        $s3 = /regex_pattern/

    condition:
        uint16(0) == 0x5A4D and ($s1 or $s2) and $s3
}

All Command-Line Options (Kali Linux yara binary)

Option	Long form	Description
-t <tag>	--tag=<tag>	Only print matches for rules tagged with <tag>
-i <identifier>	--identifier=<identifier>	Only print matches for rules named <identifier>
-n	--negate	Print only rules that did not match
-g	--print-tags	Print rule tags
-m	--print-meta	Print rule metadata
-D	--print-module-data	Print module data (e.g., PE header fields used)
-e	--print-namespace	Print rule namespace
-S	--print-stats	Print rule-matching performance statistics
-s	--print-strings	Print matching strings and their offsets
-L	--print-string-length	Print length of matched strings
-X	--print-xor-key	Print XOR key used, if xor modifier matched
-r	--recursive	Recursively scan directories
-f	--fast-scan	Fast matching mode (stop after first match per string)
-w	--no-warnings	Disable warning messages
-d <id>=<value>	--define=<id>=<value>	Define an external variable for use in conditions
-x <mod>=<file>	--module-data=<mod>=<file>	Pass extra data to a module
-a <seconds>	--timeout=<seconds>	Abort scanning after N seconds
-k <seconds>	--stack-size=<slots>	Set maximum stack size for the rule VM
-p <n>	--threads=<n>	Use N threads for scanning
-l <n>	--max-rules=<n>	Abort scanning after matching N rules
-C	--compiled-rules	Treat RULES_FILE as a pre-compiled rules file
-N	--no-follow-symlinks	Don’t follow symlinks while scanning
-h	--help	Show help
-v	--version	Show version

yarac (the rule compiler) — compiles .yar rules into a faster-loading binary format:

yarac rules.yar compiled_rules.yrc
yara -C compiled_rules.yrc target_file

Basic Usage (Expected Output)

$ yara my_rule.yar suspicious.exe

Expected output when a rule matches:

Trojan_Generic suspicious.exe

Nothing is printed if there is no match.

With verbose flags:

$ yara -s -m my_rule.yar suspicious.exe
Trojan_Generic [author="analyst",description="detects sample X"] suspicious.exe
0x1040:$s1: malicious_string
0x2af0:$s2: E8 12 34 56 78 5D C3

Practical Examples with Output

Example 1 — Scan a single file

$ yara malware_rules.yar sample.exe
Emotet_Loader sample.exe

Example 2 — Recursively scan a directory

$ yara -r malware_rules.yar /home/analyst/samples/
Emotet_Loader /home/analyst/samples/batch1/sample1.exe
Cobalt_Strike_Beacon /home/analyst/samples/batch1/beacon.bin

Example 3 — Show matched strings with offsets

$ yara -s malware_rules.yar sample.exe
Emotet_Loader sample.exe
0x1a2f:$str_cmd: cmd.exe /c powershell -enc
0x2044:$str_mutex: Global\\EmotetMutex2024

Example 4 — Print rule metadata and tags

$ yara -m -g malware_rules.yar sample.exe
Emotet_Loader [banker,trojan] [family="Emotet",severity="high"] sample.exe

Example 5 — Scan a running process by PID

$ sudo yara -p 4 injected_rules.yar 6821
CobaltStrike_Beacon_Memory 6821

Example 6 — Using the pe module to check a compile timestamp and section count

import "pe"
rule Suspicious_PE_Timestamp
{
    condition:
        pe.timestamp < 946684800 and pe.number_of_sections > 8
}

$ yara -D pe_rules.yar sample.exe
Suspicious_PE_Timestamp sample.exe
pe.timestamp: 915148800
pe.number_of_sections: 10

Example 7 — Negate match (find files that do NOT match a known-good rule)

$ yara -n known_good.yar /mnt/samples/*.exe
KnownGood_Signed_Binary /mnt/samples/unsigned_tool.exe

Example 8 — Using external variables in a condition

rule Filesize_Check
{
    condition:
        filesize < filesize_limit
}

$ yara -d filesize_limit=1048576 size_rule.yar sample.bin
Filesize_Check sample.bin

Example 9 — Compile rules for faster repeated scanning

$ yarac big_ruleset.yar big_ruleset.yrc
$ time yara -C big_ruleset.yrc -r /mnt/samples/
real    0m1.204s

Example 10 — Multi-threaded recursive scan with a timeout

$ yara -r -p 8 -a 60 malware_rules.yar /mnt/evidence/
Ransomware_LockBit /mnt/evidence/case001/payload.exe

Example 11 — Hex wildcard pattern matching

rule Shellcode_NOP_Sled
{
    strings:
        $nop = { 90 90 90 90 90 ?? ?? ?? ?? }
    condition:
        $nop
}

$ yara nop_rule.yar shellcode.bin
Shellcode_NOP_Sled shellcode.bin

Example 12 — Regex string with count condition

rule Multiple_IP_Addresses
{
    strings:
        $ip = /\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/
    condition:
        #ip >= 5
}

$ yara ip_rule.yar config_dump.txt
Multiple_IP_Addresses config_dump.txt

Common Use Cases

• Malware family classification — tag and name samples based on known indicators.
• Threat hunting — sweep an entire disk image, mounted evidence, or file share for IOCs.
• YARA-on-memory — scan live processes or memory dumps (via Volatility’s yarascan) for injected shellcode or fileless malware.
• Automated triage pipelines — integrated into sandboxes (Cuckoo, CAPEv2), SOAR playbooks, and antivirus engines (ClamAV supports YARA rules).
• VirusTotal retro-hunting — the same rule syntax is used to hunt VirusTotal’s live and historical corpus.
• Incident response — quickly sweep an entire fleet for a newly discovered IOC before full remediation.

Automation with Bash

Batch scan and log results with timestamps:

#!/bin/bash
RULES="/opt/yara-rules/all_rules.yar"
TARGET_DIR="/mnt/samples"
LOGFILE="/var/log/yara_scan_$(date +%F).log"

echo "[*] Starting YARA scan: $(date)" | tee -a "$LOGFILE"
yara -r -s -m -w "$RULES" "$TARGET_DIR" | tee -a "$LOGFILE"
echo "[*] Scan complete: $(date)" | tee -a "$LOGFILE"

Alert only on matches (for cron/SOC pipeline):

#!/bin/bash
MATCHES=$(yara -r /opt/yara-rules/all_rules.yar /mnt/incoming/)
if [ -n "$MATCHES" ]; then
    echo "$MATCHES" | mail -s "YARA ALERT: Malware detected" soc@example.com
fi

Recompile all rule files nightly for performance:

#!/bin/bash
for rule in /opt/yara-rules/*.yar; do
    yarac "$rule" "${rule%.yar}.yrc"
done

Tips and Best Practices

• Keep string identifiers descriptive ($cmd_exec not $s1) — future-you will thank you.
• Use nocase, wide, and ascii modifiers to catch case variants and UTF-16 strings common in Windows malware.
• Prefer specific hex/opcode patterns over long plaintext strings — plaintext strings are trivial for malware authors to obfuscate.
• Use the pe, elf, and hash modules for structural conditions instead of relying purely on strings — this reduces false positives.
• Compile rules (yarac) in production/high-volume pipelines — compiled rules load significantly faster.
• Version-control your rule repository and tag rules with author, date, reference, and hash metadata for provenance.
• Test new rules against a large “known-good” corpus before deploying to avoid false-positive floods.
• Use -f (fast-scan) for high-volume scanning where only “does it match” matters, not every occurrence.

Troubleshooting

Problem	Cause / Fix
error: syntax error, unexpected ...	Malformed rule syntax — check for missing colons, braces, or semicolons
warning: rule "X" is slow	Overly broad regex or wildcard hex string — narrow the pattern
No matches on a known-bad file	Check string modifiers (nocase/wide), confirm condition logic, test each string individually with -s
yara: error scanning ...: Permission denied	Run with elevated privileges when scanning process memory (sudo)
Compiled rules (-C) fail to load	Compiled rules are version-specific — recompile with the same yara/yarac version installed
Extremely slow scans on large directories	Use -p for multithreading, -f for fast-scan mode, and compiled rulesets
Module (pe, elf) fields return undefined	The module wasn’t built into your YARA binary — rebuild from source with --enable-<module>, or install yara with full module support

References

• Official documentation: https://yara.readthedocs.io/
• GitHub repository: https://github.com/VirusTotal/yara
• YARA rules community repositories: https://github.com/Yara-Rules/rules, https://github.com/reversinglabs/reversinglabs-yara-rules
• Kali Linux tool page: https://www.kali.org/tools/yara/