# Yara Rule Authoring

Guides authoring of high-quality YARA-X detection rules for malware identification.

- Repository: https://github.com/trailofbits/skills (7935 stars)
- Category: Security
- License: CC-BY-SA-4.0
- Last updated: 2026-10-28
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add trailofbits/skills --skill yara-rule-authoring -g -a claude-code -y`
Codex: `npx skills add trailofbits/skills --skill yara-rule-authoring -g -a codex -y`
Cursor: `npx skills add trailofbits/skills --skill yara-rule-authoring -g -a cursor -y`
Gemini CLI: `npx skills add trailofbits/skills --skill yara-rule-authoring -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add trailofbits/skills`

## Description

Guides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules. Covers naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive reduction. Triggers on: YARA, YARA-X, malware detection, threat hunting, IOC, signature, crx module, dex module.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# YARA-X Rule Authoring

Write detection rules that catch malware without drowning in false positives.

Resolve the [linter](scripts/yara_lint.py), [atom analyzer](scripts/atom_analyzer.py),
and [review helper](scripts/review.sh) from this installed `SKILL.md`'s directory.
In commands below, replace each `<resolved-...-path>` with that script's absolute
path and keep the quotes. The rule file or directory is still relative to your
working directory unless you pass an absolute input path.

**This skill targets YARA-X**, the Rust-based successor to legacy YARA, 5-10x faster regex, better errors, built-in formatter, stricter validation, new modules (crx, dex), 99% rule compatibility. It powers VirusTotal's production systems. Install with `brew install yara-x` or `cargo install yara-x`; the CLI is `yr`. See [Migrating from Legacy YARA](#migrating-from-legacy-yara) for existing rules.

## Core Principles

1. **Strings must generate good atoms**, YARA extracts 4-byte subsequences for fast matching. Strings with repeated bytes, common sequences, or under 4 bytes force slow bytecode verification on too many files.

2. **Target specific families, not categories**, "Detects ransomware" catches everything and nothing. "Detects LockBit 3.0 configuration extraction routine" catches what you want.

3. **Test against goodware before deployment**, A rule that fires on Windows system files is useless. Validate against VirusTotal's goodware corpus or your own clean file set.

4. **Short-circuit with cheap checks first**, `filesize` (instant), then magic bytes (nearly instant), then strings (cheap), then modules (expensive).

5. **Metadata is documentation**, Future you (and your team) need to know what this catches, why, and where the sample came from.

## When to Use

The rest: https://github.com/trailofbits/skills/blob/HEAD/plugins/yara-authoring/skills/yara-rule-authoring/SKILL.md