Yara Rule Authoring
Guides authoring of high-quality YARA-X detection rules for malware identification.
Install
npx skills add trailofbits/skills --skill yara-rule-authoring -g -a claude-code -y- Repository
- trailofbits/skills7.9k
- Category
- Security
- Updated
- 7d ago
- License
- CC-BY-SA-4.0
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- Yes, review before use
What it does
Guides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules. Covers naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive reduction. Triggers on: YARA, YARA-X, malware detection, threat hunting, IOC, signature, crx module, dex module.
YARA-X Rule Authoring
Write detection rules that catch malware without drowning in false positives.
Resolve the linter, atom analyzer,
and review helper from this installed SKILL.md's directory.
In commands below, replace each <resolved-...-path> with that script's absolute
path and keep the quotes. The rule file or directory is still relative to your
working directory unless you pass an absolute input path.
This skill targets YARA-X, the Rust-based successor to legacy YARA, 5-10x faster regex, better errors, built-in formatter, stricter validation, new modules (crx, dex), 99% rule compatibility. It powers VirusTotal's production systems. Install with brew install yara-x or cargo install yara-x; the CLI is yr. See Migrating from Legacy YARA for existing rules.
Core Principles
-
Strings must generate good atoms, YARA extracts 4-byte subsequences for fast matching. Strings with repeated bytes, common sequences, or under 4 bytes force slow bytecode verification on too many files.
-
Target specific families, not categories, "Detects ransomware" catches everything and nothing. "Detects LockBit 3.0 configuration extraction routine" catches what you want.
-
Test against goodware before deployment, A rule that fires on Windows system files is useless. Validate against VirusTotal's goodware corpus or your own clean file set.
-
Short-circuit with cheap checks first,
filesize(instant), then magic bytes (nearly instant), then strings (cheap), then modules (expensive). -
Metadata is documentation, Future you (and your team) need to know what this catches, why, and where the sample came from.
