yara.1

yara

NAME
SYNOPSIS
DESCRIPTION
EXAMPLES
AUTHOR

---

NAME

yara − find files matching patterns and rules written in a special-purpose language.

SYNOPSIS

yara [OPTION]… [NAMESPACE:]RULES_FILE… FILE | DIR | PID

DESCRIPTION

yara scans the given FILE, all files contained in directory DIR, or the process identified by PID looking for matches of patterns and rules provided in a special purpose-language. The rules are read from one or more RULES_FILE.

The options to yara(1) are: **
—atom-quality-table**

Path to a file with the atom quality table.

−C —compiled-rules

RULES_FILE contains rules already compiled with yarac.

−c —count

Print number of matches only.

−d —define*=identifier=value*

Define an external variable. This option can be used multiple times.

—fail-on-warnings

Treat warnings as errors. Has no effect if used with —no-warnings.

−f —fast-scan

Speeds up scanning by searching only for the first occurrence of each pattern.

−i identifier **—identifier=**identifier

Print rules named identifier and ignore the rest. This option can be used multiple times.

**—max-process-memory-chunk=**size

While scanning process memory read data in chunks of the given size in bytes.

−l number **—max-rules=**number

Abort scanning after a number of rules matched.

**—max-strings-per-rule=**number

Set maximum number of strings per rule (default=10000)

−x —module-data*=module=file*

Pass file’s content as extra data to module. This option can be used multiple times.

−n —negate

Print rules that doesn’t apply (negate).

−w —no-warnings

Disable warnings.

−m —print-meta

Print metadata associated to the rule.

−D —print-module-data

Print module data.

−M —module-names

show module names

−e —print-namespace

Print namespace associated to the rule.

−S —print-stats

Print rules’ statistics.

−s —print-strings

Print strings found in the file.

−L —print-string-length

Print length of strings found in the file.

−X —print-xor-key

Print xor key of matched strings.

−g —print-tags

Print the tags associated to the rule.

−r —recursive

Scan files in directories recursively. It follows symlinks.

—scan-list

Scan files listed in FILE, one per line.

−z size **—skip-larger=**size

Skip files larger than the given size in bytes when scanning a directory.

−k slots **—stack-size=**slots

Set maximum stack size to the specified number of slots.

—strict-escape

Print warnings if rules contain ambiguous escape statements.

−t tag **—tag=**tag

Print rules tagged as tag and ignore the rest. This option can be used multiple times.

−p number **—threads=**number

Use the specified number of threads to scan a directory.

−a seconds **—timeout=**seconds

Abort scanning after a number of seconds has elapsed.

−v —version

Show version information.

EXAMPLES

$ yara /foo/bar/rules .

Apply rules on /foo/bar/rules to all files on current directory. Subdirectories are not scanned.

$ yara -t Packer -t Compiler /foo/bar/rules bazfile

Apply rules on /foo/bar/rules to bazfile. Only reports rules tagged as Packer or Compiler.

$ cat /foo/bar/rules | yara -r /foo

Scan all files in the /foo directory and its subdirectories. Rules are read from standard input.

$ yara -d mybool=true -d myint=5 -d mystring=“my string” /foo/bar/rules bazfile

Defines three external variables mybool myint and mystring.

$ yara -x cuckoo=cuckoo_json_report /foo/bar/rules bazfile

Apply rules on /foo/bar/rules to bazfile while passing the content of cuckoo_json_report to the cuckoo module.

AUTHOR

Victor M. Alvarez <plusvic@gmail.com>;<vmalvarez@virustotal.com>

---