[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-trail-of-bits-yara-rule-authoring":3,"mdc--rk9bec-key":32,"related-repo-trail-of-bits-yara-rule-authoring":4725,"related-org-trail-of-bits-yara-rule-authoring":4823},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":20,"repoUrl":21,"updatedAt":22,"license":23,"forks":24,"topics":25,"repo":27,"sourceUrl":30,"mdContent":31},"yara-rule-authoring","author YARA detection rules","Guides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules. Covers naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive reduction. Triggers on: YARA, YARA-X, malware detection, threat hunting, IOC, signature, crx module, dex module.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"trail-of-bits","Trail of Bits","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Ftrail-of-bits.png","trailofbits",[13,17],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"Code Analysis","code-analysis",6139,"https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills","2026-07-17T06:05:30.708846",null,541,[26],"agent-skills",{"repoUrl":21,"stars":20,"forks":24,"topics":28,"description":29},[26],"Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows","https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills\u002Ftree\u002FHEAD\u002Fplugins\u002Fyara-authoring\u002Fskills\u002Fyara-rule-authoring","---\nname: yara-rule-authoring\ndescription: >\n  Guides authoring of high-quality YARA-X detection rules for malware identification.\n  Use when writing, reviewing, or optimizing YARA rules. Covers naming conventions,\n  string selection, performance optimization, migration from legacy YARA, and false\n  positive reduction. Triggers on: YARA, YARA-X, malware detection, threat hunting,\n  IOC, signature, crx module, dex module.\n---\n\n# YARA-X Rule Authoring\n\nWrite detection rules that catch malware without drowning in false positives.\n\n> **This skill targets YARA-X**, the Rust-based successor to legacy YARA. YARA-X powers VirusTotal's production systems and is the recommended implementation. See [Migrating from Legacy YARA](#migrating-from-legacy-yara) if you have existing rules.\n\n## Core Principles\n\n1. **Strings must generate good atoms** — YARA extracts 4-byte subsequences for fast matching. Strings with repeated bytes, common sequences, or under 4 bytes force slow bytecode verification on too many files.\n\n2. **Target specific families, not categories** — \"Detects ransomware\" catches everything and nothing. \"Detects LockBit 3.0 configuration extraction routine\" catches what you want.\n\n3. **Test against goodware before deployment** — A rule that fires on Windows system files is useless. Validate against VirusTotal's goodware corpus or your own clean file set.\n\n4. **Short-circuit with cheap checks first** — Put `filesize \u003C 10MB and uint16(0) == 0x5A4D` before expensive string searches or module calls.\n\n5. **Metadata is documentation** — Future you (and your team) need to know what this catches, why, and where the sample came from.\n\n## When to Use\n\n- Writing new YARA-X rules for malware detection\n- Reviewing existing rules for quality or performance issues\n- Optimizing slow-running rulesets\n- Converting IOCs or threat intel into detection signatures\n- Debugging false positive issues\n- Preparing rules for production deployment\n- Migrating legacy YARA rules to YARA-X\n- Analyzing Chrome extensions (crx module)\n- Analyzing Android apps (dex module)\n\n## When NOT to Use\n\n- Static analysis requiring disassembly → use Ghidra\u002FIDA skills\n- Dynamic malware analysis → use sandbox analysis skills\n- Network-based detection → use Suricata\u002FSnort skills\n- Memory forensics with Volatility → use memory forensics skills\n- Simple hash-based detection → just use hash lists\n\n## YARA-X Overview\n\nYARA-X is the Rust-based successor to legacy YARA: 5-10x faster regex, better errors, built-in formatter, stricter validation, new modules (crx, dex), 99% rule compatibility.\n\n**Install:** `brew install yara-x` (macOS) or `cargo install yara-x`\n\n**Essential commands:** `yr scan`, `yr check`, `yr fmt`, `yr dump`\n\n## Platform Considerations\n\nYARA works on any file type. Adapt patterns to your target:\n\n| Platform | Magic Bytes | Bad Strings | Good Strings |\n|----------|-------------|-------------|--------------|\n| **Windows PE** | `uint16(0) == 0x5A4D` | API names, Windows paths | Mutex names, PDB paths |\n| **macOS Mach-O** | `uint32(0) == 0xFEEDFACE` (32-bit), `0xFEEDFACF` (64-bit), `0xCAFEBABE` (universal) | Common Obj-C methods | Keylogger strings, persistence paths |\n| **JavaScript\u002FNode** | (none needed) | `require`, `fetch`, `axios` | Obfuscator signatures, eval+decode chains |\n| **npm\u002Fpip packages** | (none needed) | `postinstall`, `dependencies` | Suspicious package names, exfil URLs |\n| **Office docs** | `uint32(0) == 0x504B0304` | VBA keywords | Macro auto-exec, encoded payloads |\n| **VS Code extensions** | (none needed) | `vscode.workspace` | Uncommon activationEvents, hidden file access |\n| **Chrome extensions** | Use `crx` module | Common Chrome APIs | Permission abuse, manifest anomalies |\n| **Android apps** | Use `dex` module | Standard DEX structure | Obfuscated classes, suspicious permissions |\n\n### macOS Malware Detection\n\nNo dedicated Mach-O module exists yet. Use magic byte checks + string patterns:\n\n**Magic bytes:**\n```yara\n\u002F\u002F Mach-O 32-bit\nuint32(0) == 0xFEEDFACE\n\u002F\u002F Mach-O 64-bit\nuint32(0) == 0xFEEDFACF\n\u002F\u002F Universal binary (fat binary)\nuint32(0) == 0xCAFEBABE or uint32(0) == 0xBEBAFECA\n```\n\n**Good indicators for macOS malware:**\n- Keylogger artifacts: `CGEventTapCreate`, `kCGEventKeyDown`\n- SSH tunnel strings: `ssh -D`, `tunnel`, `socks`\n- Persistence paths: `~\u002FLibrary\u002FLaunchAgents`, `\u002FLibrary\u002FLaunchDaemons`\n- Credential theft: `security find-generic-password`, `keychain`\n\n**Example pattern from Airbnb BinaryAlert:**\n```yara\nrule SUSP_Mac_ProtonRAT\n{\n    strings:\n        \u002F\u002F Library indicators\n        $lib1 = \"SRWebSocket\" ascii\n        $lib2 = \"SocketRocket\" ascii\n\n        \u002F\u002F Behavioral indicators\n        $behav1 = \"SSH tunnel not launched\" ascii\n        $behav2 = \"Keylogger\" ascii\n\n    condition:\n        (uint32(0) == 0xFEEDFACF or uint32(0) == 0xCAFEBABE) and\n        any of ($lib*) and any of ($behav*)\n}\n```\n\n### JavaScript Detection Decision Tree\n\n```\nWriting a JavaScript rule?\n├─ npm package?\n│  ├─ Check package.json patterns\n│  ├─ Look for postinstall\u002Fpreinstall hooks\n│  └─ Target exfil patterns: fetch + env access + credential paths\n├─ Browser extension?\n│  ├─ Chrome: Use crx module\n│  └─ Others: Target manifest patterns, background script behaviors\n├─ Standalone JS file?\n│  ├─ Look for obfuscation markers: eval+atob, fromCharCode chains\n│  ├─ Target unique function\u002Fvariable names (often survive minification)\n│  └─ Check for packed\u002Fencoded payloads\n└─ Minified\u002Fwebpack bundle?\n   ├─ Target unique strings that survive bundling (URLs, magic values)\n   └─ Avoid function names (will be mangled)\n```\n\n**JavaScript-specific good strings:**\n- Ethereum function selectors: `{ 70 a0 82 31 }` (transfer)\n- Zero-width characters (steganography): `{ E2 80 8B E2 80 8C }`\n- Obfuscator signatures: `_0x`, `var _0x`\n- Specific C2 patterns: domain names, webhook URLs\n\n**JavaScript-specific bad strings:**\n- `require`, `fetch`, `axios` — too common\n- `Buffer`, `crypto` — legitimate uses everywhere\n- `process.env` alone — need specific env var names\n\n## Essential Toolkit\n\n| Tool | Purpose |\n|------|---------|\n| **yarGen** | Extract candidate strings: `yarGen.py -m samples\u002F --excludegood` → validate with `yr check` |\n| **FLOSS** | Extract obfuscated\u002Fstack strings: `floss sample.exe` (when yarGen fails) |\n| **yr CLI** | Validate: `yr check`, scan: `yr scan -s`, inspect: `yr dump -m pe` |\n| **signature-base** | Study quality examples |\n| **YARA-CI** | Goodware corpus testing before deployment |\n\nMaster these five. Don't get distracted by tool catalogs.\n\n## Rationalizations to Reject\n\nWhen you catch yourself thinking these, stop and reconsider.\n\n| Rationalization | Expert Response |\n|-----------------|-----------------|\n| \"This generic string is unique enough\" | Test against goodware first. Your intuition is wrong. |\n| \"yarGen gave me these strings\" | yarGen suggests, you validate. Check each one manually. |\n| \"It works on my 10 samples\" | 10 samples ≠ production. Use VirusTotal goodware corpus. |\n| \"One rule to catch all variants\" | Causes FP floods. Target specific families. |\n| \"I'll make it more specific if we get FPs\" | Write tight rules upfront. FPs burn trust. |\n| \"This hex pattern is unique\" | Unique in one sample ≠ unique across malware ecosystem. |\n| \"Performance doesn't matter\" | One slow rule slows entire ruleset. Optimize atoms. |\n| \"PEiD rules still work\" | Obsolete. 32-bit packers aren't relevant. |\n| \"I'll add more conditions later\" | Weak rules deployed = damage done. |\n| \"This is just for hunting\" | Hunting rules become detection rules. Same quality bar. |\n| \"The API name makes it malicious\" | Legitimate software uses same APIs. Need behavioral context. |\n| \"any of them is fine for these common strings\" | Common strings + any = FP flood. Use `any of` only for individually unique strings. |\n| \"This regex is specific enough\" | `\u002Ffetch.*token\u002F` matches all auth code. Add exfil destination requirement. |\n| \"The JavaScript looks clean\" | Attackers poison legitimate code with injects. Check for eval+decode chains. |\n| \"I'll use .* for flexibility\" | Unbounded regex = performance disaster + memory explosion. Use `.{0,30}`. |\n| \"I'll use --relaxed-re-syntax everywhere\" | Masks real bugs. Fix the regex instead of hiding problems. |\n\n## Decision Trees\n\n### Is This String Good Enough?\n\n```\nIs this string good enough?\n├─ Less than 4 bytes?\n│  └─ NO — find longer string\n├─ Contains repeated bytes (0000, 9090)?\n│  └─ NO — add surrounding context\n├─ Is an API name (VirtualAlloc, CreateRemoteThread)?\n│  └─ NO — use hex pattern of call site instead\n├─ Appears in Windows system files?\n│  └─ NO — too generic, find something unique\n├─ Is it a common path (C:\\Windows\\, cmd.exe)?\n│  └─ NO — find malware-specific paths\n├─ Unique to this malware family?\n│  └─ YES — use it\n└─ Appears in other malware too?\n   └─ MAYBE — combine with family-specific marker\n```\n\n### When to Use \"all of\" vs \"any of\"\n\n```\nShould I require all strings or allow any?\n├─ Strings are individually unique to malware?\n│  └─ any of them (each alone is suspicious)\n├─ Strings are common but combination is suspicious?\n│  └─ all of them (require the full pattern)\n├─ Strings have different confidence levels?\n│  └─ Group: all of ($core_*) and any of ($variant_*)\n└─ Seeing many false positives?\n   └─ Tighten: switch any → all, add more required strings\n```\n\n**Lesson from production:** Rules using `any of ($network_*)` where strings included \"fetch\", \"axios\", \"http\" matched virtually all web applications. Switching to require credential path AND network call AND exfil destination eliminated FPs.\n\n### When to Abandon a Rule Approach\n\nStop and pivot when:\n\n- **yarGen returns only API names and paths** → See [When Strings Fail, Pivot to Structure](#when-strings-fail-pivot-to-structure)\n\n- **Can't find 3 unique strings** → Probably packed. Target the unpacked version or detect the packer.\n\n- **Rule matches goodware files** → Strings aren't unique enough. 1-2 matches = investigate and tighten; 3-5 matches = find different indicators; 6+ matches = start over.\n\n- **Performance is terrible even after optimization** → Architecture problem. Split into multiple focused rules or add strict pre-filters.\n\n- **Description is hard to write** → The rule is too vague. If you can't explain what it catches, it catches too much.\n\n### Debugging False Positives\n\n```\nFP Investigation Flow:\n│\n├─ 1. Which string matched?\n│     Run: yr scan -s rule.yar false_positive.exe\n│\n├─ 2. Is it in a legitimate library?\n│     └─ Add: not $fp_vendor_string exclusion\n│\n├─ 3. Is it a common development pattern?\n│     └─ Find more specific indicator, replace the string\n│\n├─ 4. Are multiple generic strings matching together?\n│     └─ Tighten to require all + add unique marker\n│\n└─ 5. Is the malware using common techniques?\n      └─ Target malware-specific implementation details, not the technique\n```\n\n### Hex vs Text vs Regex\n\n```\nWhat string type should I use?\n│\n├─ Exact ASCII\u002FUnicode text?\n│  └─ TEXT: $s = \"MutexName\" ascii wide\n│\n├─ Specific byte sequence?\n│  └─ HEX: $h = { 4D 5A 90 00 }\n│\n├─ Byte sequence with variation?\n│  └─ HEX with wildcards: { 4D 5A ?? ?? 50 45 }\n│\n├─ Pattern with structure (URLs, paths)?\n│  └─ BOUNDED REGEX: \u002Fhttps:\\\u002F\\\u002F[a-z]{5,20}\\.onion\u002F\n│\n└─ Unknown encoding (XOR, base64)?\n   └─ TEXT with modifier: $s = \"config\" xor(0x00-0xFF)\n```\n\n### Is the Sample Packed? (Check First)\n\nBefore writing any string-based rule:\n\n```\nIs the sample packed?\n├─ Entropy > 7.0?\n│  └─ Likely packed — find unpacked layer first\n├─ Few\u002Fno readable strings?\n│  └─ Likely packed — use entropy, PE structure, or packer signatures\n├─ UPX\u002FMPRESS\u002Fcustom packer detected?\n│  └─ Target the unpacked payload OR detect the packer itself\n└─ Readable strings available?\n   └─ Proceed with string-based detection\n```\n\n**Expert guidance:** Don't write rules against packed layers. The packing changes; the payload doesn't.\n\n### When Strings Fail, Pivot to Structure\n\nIf yarGen returns only API names and generic paths:\n\n```\nString extraction failed — what now?\n├─ High entropy sections?\n│  └─ Use math.entropy() on specific sections\n├─ Unusual imports pattern?\n│  └─ Use pe.imphash() for import hash clustering\n├─ Consistent PE structure anomalies?\n│  └─ Target section names, sizes, characteristics\n├─ Metadata present?\n│  └─ Target version info, timestamps, resources\n└─ Nothing unique?\n   └─ This sample may not be detectable with YARA alone\n```\n\n**Expert guidance:** \"One can try to use other file properties, such as metadata, entropy, import hashes or other data which stays constant.\" — Kaspersky Applied YARA Training\n\n## Expert Heuristics\n\n**String selection:** Mutex names are gold; C2 paths silver; error messages bronze. Stack strings are almost always unique. If you need >6 strings, you're over-fitting.\n\n**Condition design:** Start with `filesize \u003C`, then magic bytes, then strings, then modules. If >5 lines, split into multiple rules.\n\n**Quality signals:** yarGen output needs 80% filtering. Rules matching \u003C50% of variants are too narrow; matching goodware are too broad.\n\n**Modifier discipline:**\n- **Never use `nocase` or `wide` speculatively** — only when you have confirmed evidence the case\u002Fencoding varies in samples\n- `nocase` doubles atom generation; `wide` doubles string matching — both have real costs\n- \"If you don't have a clear reason for using those modifiers, don't do it\" — Kaspersky Applied YARA\n\n**Regex anchoring:**\n- Regex without a 4+ byte literal substring **evaluates at every file offset** — catastrophic performance\n- Always anchor regex to a distinctive literal: `\u002Fmshta\\.exe http:\\\u002F\\\u002F...\u002F` not `\u002Fhttp:\\\u002F\\\u002F...\u002F`\n- If you can't anchor, consider hex pattern with wildcards instead\n\n**Loop discipline:**\n- Always bound loops with filesize: `filesize \u003C 100KB and for all i in (1..#a) : ...`\n- Unbounded `#a` can be thousands in large files — exponential slowdown\n\n**YARA-X tips:** `$_unused` to suppress warnings; `private $s` to hide from output; `yr check` + `yr fmt` before every commit.\n\n### When to Use Modules vs. Byte Checks\n\n```\nShould I use a module or raw bytes?\n├─ Need imphash\u002Frich header\u002Fauthenticode?\n│  └─ Use PE module — too complex to replicate\n├─ Just checking magic bytes or simple offsets?\n│  └─ Use uint16\u002Fuint32 — faster, no module overhead\n├─ Checking section names\u002Fsizes?\n│  └─ PE module is cleaner, but add magic bytes filter FIRST\n├─ Checking Chrome extension permissions?\n│  └─ Use crx module — string parsing is fragile\n└─ Checking LNK target paths?\n   └─ Use lnk module — LNK format is complex\n```\n\n**Expert guidance:** \"Avoid the magic module — use explicit hex checks instead\" — Neo23x0. Apply this principle: if you can do it with uint32(), don't load a module.\n\n## YARA-X New Features\n\nKey additions from recent releases:\n\n- **Private patterns** (v1.3.0+): `private $helper = \"pattern\"` — matches but hidden from output\n- **Warning suppression** (v1.4.0+): `\u002F\u002F suppress: slow_pattern` inline comments\n- **Numeric underscores** (v1.5.0+): `filesize \u003C 10_000_000` for readability\n- **Built-in formatter**: `yr fmt rules\u002F` to standardize formatting\n- **NDJSON output**: `yr scan --output-format ndjson` for tooling\n\n## YARA-X Tooling Workflow\n\nYARA-X provides diagnostic tools legacy YARA lacks:\n\n**Rule development cycle:**\n```bash\n# 1. Write initial rule\n# 2. Check syntax with detailed errors\nyr check rule.yar\n\n# 3. Format consistently\nyr fmt -w rule.yar\n\n# 4. Dump module output to inspect file structure (no dummy rule needed)\nyr dump -m pe sample.exe --output-format yaml\n\n# 5. Scan with timing info\ntime yr scan -s rule.yar corpus\u002F\n```\n\n**When to use `yr dump`:**\n- Investigating what PE\u002FELF\u002FMach-O fields are available\n- Debugging why module conditions aren't matching\n- Exploring new modules (crx, lnk, dotnet) before writing rules\n\n**YARA-X diagnostic advantage:** Error messages include precise source locations. If `yr check` points to line 15, the issue is actually on line 15 (unlike legacy YARA).\n\n## Chrome Extension Analysis (crx module)\n\nThe `crx` module enables detection of malicious Chrome extensions. Requires YARA-X v1.5.0+ (basic), v1.11.0+ for `permhash()`.\n\n**Key APIs:** `crx.is_crx`, `crx.permissions`, `crx.permhash()`\n\n**Red flags:** `nativeMessaging` + `downloads`, `debugger` permission, content scripts on `\u003Call_urls>`\n\n```yara\nimport \"crx\"\n\nrule SUSP_CRX_HighRiskPerms {\n    condition:\n        crx.is_crx and\n        for any perm in crx.permissions : (perm == \"debugger\")\n}\n```\n\nSee [crx-module.md](references\u002Fcrx-module.md) for complete API reference, permission risk assessment, and example rules.\n\n## Android DEX Analysis (dex module)\n\nThe `dex` module enables detection of Android malware. Requires YARA-X v1.11.0+. **Not compatible with legacy YARA's dex module** — API is completely different.\n\n**Key APIs:** `dex.is_dex`, `dex.contains_class()`, `dex.contains_method()`, `dex.contains_string()`\n\n**Red flags:** Single-letter class names (obfuscation), `DexClassLoader` reflection, encrypted assets\n\n```yara\nimport \"dex\"\n\nrule SUSP_DEX_DynamicLoading {\n    condition:\n        dex.is_dex and\n        dex.contains_class(\"Ldalvik\u002Fsystem\u002FDexClassLoader;\")\n}\n```\n\nSee [dex-module.md](references\u002Fdex-module.md) for complete API reference, obfuscation detection, and example rules.\n\n## Migrating from Legacy YARA\n\nYARA-X has 99% rule compatibility, but enforces stricter validation.\n\n**Quick migration:**\n```bash\nyr check --relaxed-re-syntax rules\u002F  # Identify issues\n# Fix each issue, then:\nyr check rules\u002F  # Verify without relaxed mode\n```\n\n**Common fixes:**\n| Issue | Legacy | YARA-X Fix |\n|-------|--------|------------|\n| Literal `{` in regex | `\u002F{\u002F` | `\u002F\\{\u002F` |\n| Invalid escapes | `\\R` silently literal | `\\\\R` or `R` |\n| Base64 strings | Any length | 3+ chars required |\n| Negative indexing | `@a[-1]` | `@a[#a - 1]` |\n| Duplicate modifiers | Allowed | Remove duplicates |\n\n> **Note:** Use `--relaxed-re-syntax` only as a diagnostic tool. Fix issues rather than relying on relaxed mode.\n\n## Quick Reference\n\n### Naming Convention\n\n```\n{CATEGORY}_{PLATFORM}_{FAMILY}_{VARIANT}_{DATE}\n```\n\n**Common prefixes:** `MAL_` (malware), `HKTL_` (hacking tool), `WEBSHELL_`, `EXPL_`, `SUSP_` (suspicious), `GEN_` (generic)\n\n**Platforms:** `Win_`, `Lnx_`, `Mac_`, `Android_`, `CRX_`\n\n**Example:** `MAL_Win_Emotet_Loader_Jan25`\n\nSee [style-guide.md](references\u002Fstyle-guide.md) for full conventions, metadata requirements, and naming examples.\n\n### Required Metadata\n\nEvery rule needs: `description` (starts with \"Detects\"), `author`, `reference`, `date`.\n\n```yara\nmeta:\n    description = \"Detects Example malware via unique mutex and C2 path\"\n    author = \"Your Name \u003Cemail@example.com>\"\n    reference = \"https:\u002F\u002Fexample.com\u002Fanalysis\"\n    date = \"2025-01-29\"\n```\n\n### String Selection\n\n**Good:** Mutex names, PDB paths, C2 paths, stack strings, configuration markers\n**Bad:** API names, common executables, format specifiers, generic paths\n\nSee [strings.md](references\u002Fstrings.md) for the full decision tree and examples.\n\n### Condition Patterns\n\n**Order conditions for short-circuit:**\n1. `filesize \u003C 10MB` (instant)\n2. `uint16(0) == 0x5A4D` (nearly instant)\n3. String matches (cheap)\n4. Module checks (expensive)\n\nSee [performance.md](references\u002Fperformance.md) for detailed optimization patterns.\n\n## Workflow\n\n1. **Gather samples** — Multiple samples; single-sample rules are brittle\n2. **Extract candidates** — `yarGen -m samples\u002F --excludegood`\n3. **Validate quality** — Use decision tree; yarGen needs 80% filtering\n4. **Write initial rule** — Follow template with proper metadata\n5. **Lint and test** — `yr check`, `yr fmt`, linter script\n6. **Goodware validation** — VirusTotal corpus or local clean files\n7. **Deploy** — Add to repo with full metadata, monitor for FPs\n\nSee [testing.md](references\u002Ftesting.md) for detailed validation workflow and FP investigation.\n\nFor a comprehensive step-by-step guide covering all phases from sample collection to deployment, see [rule-development.md](workflows\u002Frule-development.md).\n\n## Common Mistakes\n\n| Mistake | Bad | Good |\n|---------|-----|------|\n| API names as indicators | `\"VirtualAlloc\"` | Hex pattern of call site + unique mutex |\n| Unbounded regex | `\u002Fhttps?:\\\u002F\\\u002F.*\u002F` | `\u002Fhttps?:\\\u002F\\\u002F[a-z0-9]{8,12}\\.onion\u002F` |\n| Missing file type filter | `pe.imports(...)` first | `uint16(0) == 0x5A4D and filesize \u003C 10MB` first |\n| Short strings | `\"abc\"` (3 bytes) | `\"abcdef\"` (4+ bytes) |\n| Unescaped braces (YARA-X) | `\u002Fconfig{key}\u002F` | `\u002Fconfig\\{key\\}\u002F` |\n\n## Performance Optimization\n\n**Quick wins:** Put `filesize` first, avoid `nocase`, bounded regex `{1,100}`, prefer hex over regex.\n\n**Red flags:** Strings \u003C4 bytes, unbounded regex (`.*`), modules without file-type filter.\n\nSee [performance.md](references\u002Fperformance.md) for atom theory and optimization details.\n\n## Reference Documents\n\n| Topic | Document |\n|-------|----------|\n| Naming and metadata conventions | [style-guide.md](references\u002Fstyle-guide.md) |\n| Performance and atom optimization | [performance.md](references\u002Fperformance.md) |\n| String types and judgment | [strings.md](references\u002Fstrings.md) |\n| Testing and validation | [testing.md](references\u002Ftesting.md) |\n| Chrome extension module (crx) | [crx-module.md](references\u002Fcrx-module.md) |\n| Android DEX module (dex) | [dex-module.md](references\u002Fdex-module.md) |\n\n## Workflows\n\n| Topic | Document |\n|-------|----------|\n| Complete rule development process | [rule-development.md](workflows\u002Frule-development.md) |\n\n## Example Rules\n\nThe `examples\u002F` directory contains real, attributed rules demonstrating best practices:\n\n| Example | Demonstrates | Source |\n|---------|--------------|--------|\n| [MAL_Win_Remcos_Jan25.yar](examples\u002FMAL_Win_Remcos_Jan25.yar) | PE malware: graduated string counts, multiple rules per family | Elastic Security |\n| [MAL_Mac_ProtonRAT_Jan25.yar](examples\u002FMAL_Mac_ProtonRAT_Jan25.yar) | macOS: Mach-O magic bytes, multi-category grouping | Airbnb BinaryAlert |\n| [MAL_NPM_SupplyChain_Jan25.yar](examples\u002FMAL_NPM_SupplyChain_Jan25.yar) | npm supply chain: real attack patterns, ERC-20 selectors | Stairwell Research |\n| [SUSP_JS_Obfuscation_Jan25.yar](examples\u002FSUSP_JS_Obfuscation_Jan25.yar) | JavaScript: obfuscator detection, density-based matching | imp0rtp3, Nils Kuhnert |\n| [SUSP_CRX_SuspiciousPermissions.yar](examples\u002FSUSP_CRX_SuspiciousPermissions.yar) | Chrome extensions: crx module, permissions | Educational |\n\n## Scripts\n\n```bash\nuv run {baseDir}\u002Fscripts\u002Fyara_lint.py rule.yar      # Validate style\u002Fmetadata\nuv run {baseDir}\u002Fscripts\u002Fatom_analyzer.py rule.yar  # Check string quality\n```\n\nSee [README.md](..\u002F..\u002FREADME.md#scripts) for detailed script documentation.\n\n## Quality Checklist\n\nBefore deploying any rule:\n\n- [ ] Name follows `{CATEGORY}_{PLATFORM}_{FAMILY}_{VARIANT}_{DATE}` format\n- [ ] Description starts with \"Detects\" and explains what\u002Fhow\n- [ ] All required metadata present (author, reference, date)\n- [ ] Strings are unique (not API names, common paths, or format strings)\n- [ ] All strings have 4+ bytes with good atom potential\n- [ ] Base64 modifier only on strings with 3+ characters\n- [ ] Regex patterns have escaped `{` and valid escape sequences\n- [ ] Condition starts with cheap checks (filesize, magic bytes)\n- [ ] Rule matches all target samples\n- [ ] Rule produces zero matches on goodware corpus\n- [ ] `yr check` passes with no errors\n- [ ] `yr fmt --check` passes (consistent formatting)\n- [ ] Linter passes with no errors\n- [ ] Peer review completed\n\n## Resources\n\n### Quality YARA Rule Repositories\n\nLearn from production rules. These repositories contain well-tested, properly attributed rules:\n\n| Repository | Focus | Maintainer |\n|------------|-------|------------|\n| [Neo23x0\u002Fsignature-base](https:\u002F\u002Fgithub.com\u002FNeo23x0\u002Fsignature-base) | 17,000+ production rules, multi-platform | Florian Roth |\n| [Elastic\u002Fprotections-artifacts](https:\u002F\u002Fgithub.com\u002Felastic\u002Fprotections-artifacts) | 1,000+ endpoint-tested rules | Elastic Security |\n| [reversinglabs\u002Freversinglabs-yara-rules](https:\u002F\u002Fgithub.com\u002Freversinglabs\u002Freversinglabs-yara-rules) | Threat research rules | ReversingLabs |\n| [imp0rtp3\u002Fjs-yara-rules](https:\u002F\u002Fgithub.com\u002Fimp0rtp3\u002Fjs-yara-rules) | JavaScript\u002Fbrowser malware | imp0rtp3 |\n| [InQuest\u002Fawesome-yara](https:\u002F\u002Fgithub.com\u002FInQuest\u002Fawesome-yara) | Curated index of resources | InQuest |\n\n### Style & Performance Guides\n\n| Guide | Purpose |\n|-------|---------|\n| [YARA Style Guide](https:\u002F\u002Fgithub.com\u002FNeo23x0\u002FYARA-Style-Guide) | Naming conventions, metadata, string prefixes |\n| [YARA Performance Guidelines](https:\u002F\u002Fgithub.com\u002FNeo23x0\u002FYARA-Performance-Guidelines) | Atom optimization, regex bounds |\n| [Kaspersky Applied YARA Training](https:\u002F\u002Fyara.readthedocs.io\u002F) | Expert techniques from production use |\n\n### Tools\n\n| Tool | Purpose |\n|------|---------|\n| [yarGen](https:\u002F\u002Fgithub.com\u002FNeo23x0\u002FyarGen) | Extract candidate strings from samples |\n| [FLOSS](https:\u002F\u002Fgithub.com\u002Fmandiant\u002Fflare-floss) | Extract obfuscated and stack strings |\n| [YARA-CI](https:\u002F\u002Fyara-ci.cloud.virustotal.com\u002F) | Automated goodware testing |\n| [YaraDbg](https:\u002F\u002Fyaradbg.dev) | Web-based rule debugger |\n\n### macOS-Specific Resources\n\n| Resource | Purpose |\n|----------|---------|\n| Apple XProtect | Production macOS rules at `\u002FSystem\u002FLibrary\u002FCoreServices\u002FXProtect.bundle\u002F` |\n| [objective-see](https:\u002F\u002Fobjective-see.org\u002F) | macOS malware research and samples |\n| [macOS Security Tools](https:\u002F\u002Fgithub.com\u002F0xmachos\u002Fmacos-security-tools) | Reference list |\n\n### Multi-Indicator Clustering Pattern\n\nProduction rules often group indicators by type:\n\n```yara\nstrings:\n    \u002F\u002F Category A: Library indicators\n    $a1 = \"SRWebSocket\" ascii\n    $a2 = \"SocketRocket\" ascii\n\n    \u002F\u002F Category B: Behavioral indicators\n    $b1 = \"SSH tunnel\" ascii\n    $b2 = \"keylogger\" ascii nocase\n\n    \u002F\u002F Category C: C2 patterns\n    $c1 = \u002Fhttps:\\\u002F\\\u002F[a-z0-9]{8,16}\\.onion\u002F\n\ncondition:\n    filesize \u003C 10MB and\n    any of ($a*) and any of ($b*)  \u002F\u002F Require evidence from BOTH categories\n```\n\n**Why this works:** Different indicator types have different confidence levels. A single C2 domain might be definitive, while you need multiple library imports to be confident. Grouping by `$a*`, `$b*`, `$c*` lets you express graduated requirements.\n",{"data":33,"body":34},{"name":4,"description":6},{"type":35,"children":36},"root",[37,46,52,76,83,147,153,202,208,236,242,247,271,308,314,319,640,647,652,660,727,735,817,825,961,967,977,985,1035,1043,1097,1103,1247,1252,1258,1263,1515,1521,1527,1536,1542,1551,1569,1575,1580,1639,1645,1654,1660,1669,1675,1680,1689,1699,1704,1709,1718,1727,1733,1743,1761,1771,1779,1830,1838,1877,1885,1912,1951,1957,1966,1975,1981,1986,2078,2084,2089,2097,2261,2276,2294,2311,2317,2336,2365,2402,2462,2475,2481,2499,2534,2551,2611,2623,2628,2633,2641,2702,2710,2868,2889,2895,2901,2910,2965,3008,3023,3035,3041,3075,3122,3128,3145,3157,3163,3171,3205,3217,3223,3314,3326,3338,3344,3504,3510,3543,3560,3570,3576,3688,3694,3729,3735,3747,3884,3890,3950,3962,3968,3973,4135,4141,4147,4152,4294,4300,4375,4381,4470,4476,4552,4558,4563,4687,4719],{"type":38,"tag":39,"props":40,"children":42},"element","h1",{"id":41},"yara-x-rule-authoring",[43],{"type":44,"value":45},"text","YARA-X Rule Authoring",{"type":38,"tag":47,"props":48,"children":49},"p",{},[50],{"type":44,"value":51},"Write detection rules that catch malware without drowning in false positives.",{"type":38,"tag":53,"props":54,"children":55},"blockquote",{},[56],{"type":38,"tag":47,"props":57,"children":58},{},[59,65,67,74],{"type":38,"tag":60,"props":61,"children":62},"strong",{},[63],{"type":44,"value":64},"This skill targets YARA-X",{"type":44,"value":66},", the Rust-based successor to legacy YARA. YARA-X powers VirusTotal's production systems and is the recommended implementation. See ",{"type":38,"tag":68,"props":69,"children":71},"a",{"href":70},"#migrating-from-legacy-yara",[72],{"type":44,"value":73},"Migrating from Legacy YARA",{"type":44,"value":75}," if you have existing rules.",{"type":38,"tag":77,"props":78,"children":80},"h2",{"id":79},"core-principles",[81],{"type":44,"value":82},"Core Principles",{"type":38,"tag":84,"props":85,"children":86},"ol",{},[87,98,108,118,137],{"type":38,"tag":88,"props":89,"children":90},"li",{},[91,96],{"type":38,"tag":60,"props":92,"children":93},{},[94],{"type":44,"value":95},"Strings must generate good atoms",{"type":44,"value":97}," — YARA extracts 4-byte subsequences for fast matching. Strings with repeated bytes, common sequences, or under 4 bytes force slow bytecode verification on too many files.",{"type":38,"tag":88,"props":99,"children":100},{},[101,106],{"type":38,"tag":60,"props":102,"children":103},{},[104],{"type":44,"value":105},"Target specific families, not categories",{"type":44,"value":107}," — \"Detects ransomware\" catches everything and nothing. \"Detects LockBit 3.0 configuration extraction routine\" catches what you want.",{"type":38,"tag":88,"props":109,"children":110},{},[111,116],{"type":38,"tag":60,"props":112,"children":113},{},[114],{"type":44,"value":115},"Test against goodware before deployment",{"type":44,"value":117}," — A rule that fires on Windows system files is useless. Validate against VirusTotal's goodware corpus or your own clean file set.",{"type":38,"tag":88,"props":119,"children":120},{},[121,126,128,135],{"type":38,"tag":60,"props":122,"children":123},{},[124],{"type":44,"value":125},"Short-circuit with cheap checks first",{"type":44,"value":127}," — Put ",{"type":38,"tag":129,"props":130,"children":132},"code",{"className":131},[],[133],{"type":44,"value":134},"filesize \u003C 10MB and uint16(0) == 0x5A4D",{"type":44,"value":136}," before expensive string searches or module calls.",{"type":38,"tag":88,"props":138,"children":139},{},[140,145],{"type":38,"tag":60,"props":141,"children":142},{},[143],{"type":44,"value":144},"Metadata is documentation",{"type":44,"value":146}," — Future you (and your team) need to know what this catches, why, and where the sample came from.",{"type":38,"tag":77,"props":148,"children":150},{"id":149},"when-to-use",[151],{"type":44,"value":152},"When to Use",{"type":38,"tag":154,"props":155,"children":156},"ul",{},[157,162,167,172,177,182,187,192,197],{"type":38,"tag":88,"props":158,"children":159},{},[160],{"type":44,"value":161},"Writing new YARA-X rules for malware detection",{"type":38,"tag":88,"props":163,"children":164},{},[165],{"type":44,"value":166},"Reviewing existing rules for quality or performance issues",{"type":38,"tag":88,"props":168,"children":169},{},[170],{"type":44,"value":171},"Optimizing slow-running rulesets",{"type":38,"tag":88,"props":173,"children":174},{},[175],{"type":44,"value":176},"Converting IOCs or threat intel into detection signatures",{"type":38,"tag":88,"props":178,"children":179},{},[180],{"type":44,"value":181},"Debugging false positive issues",{"type":38,"tag":88,"props":183,"children":184},{},[185],{"type":44,"value":186},"Preparing rules for production deployment",{"type":38,"tag":88,"props":188,"children":189},{},[190],{"type":44,"value":191},"Migrating legacy YARA rules to YARA-X",{"type":38,"tag":88,"props":193,"children":194},{},[195],{"type":44,"value":196},"Analyzing Chrome extensions (crx module)",{"type":38,"tag":88,"props":198,"children":199},{},[200],{"type":44,"value":201},"Analyzing Android apps (dex module)",{"type":38,"tag":77,"props":203,"children":205},{"id":204},"when-not-to-use",[206],{"type":44,"value":207},"When NOT to Use",{"type":38,"tag":154,"props":209,"children":210},{},[211,216,221,226,231],{"type":38,"tag":88,"props":212,"children":213},{},[214],{"type":44,"value":215},"Static analysis requiring disassembly → use Ghidra\u002FIDA skills",{"type":38,"tag":88,"props":217,"children":218},{},[219],{"type":44,"value":220},"Dynamic malware analysis → use sandbox analysis skills",{"type":38,"tag":88,"props":222,"children":223},{},[224],{"type":44,"value":225},"Network-based detection → use Suricata\u002FSnort skills",{"type":38,"tag":88,"props":227,"children":228},{},[229],{"type":44,"value":230},"Memory forensics with Volatility → use memory forensics skills",{"type":38,"tag":88,"props":232,"children":233},{},[234],{"type":44,"value":235},"Simple hash-based detection → just use hash lists",{"type":38,"tag":77,"props":237,"children":239},{"id":238},"yara-x-overview",[240],{"type":44,"value":241},"YARA-X Overview",{"type":38,"tag":47,"props":243,"children":244},{},[245],{"type":44,"value":246},"YARA-X is the Rust-based successor to legacy YARA: 5-10x faster regex, better errors, built-in formatter, stricter validation, new modules (crx, dex), 99% rule compatibility.",{"type":38,"tag":47,"props":248,"children":249},{},[250,255,257,263,265],{"type":38,"tag":60,"props":251,"children":252},{},[253],{"type":44,"value":254},"Install:",{"type":44,"value":256}," ",{"type":38,"tag":129,"props":258,"children":260},{"className":259},[],[261],{"type":44,"value":262},"brew install yara-x",{"type":44,"value":264}," (macOS) or ",{"type":38,"tag":129,"props":266,"children":268},{"className":267},[],[269],{"type":44,"value":270},"cargo install yara-x",{"type":38,"tag":47,"props":272,"children":273},{},[274,279,280,286,288,294,295,301,302],{"type":38,"tag":60,"props":275,"children":276},{},[277],{"type":44,"value":278},"Essential commands:",{"type":44,"value":256},{"type":38,"tag":129,"props":281,"children":283},{"className":282},[],[284],{"type":44,"value":285},"yr scan",{"type":44,"value":287},", ",{"type":38,"tag":129,"props":289,"children":291},{"className":290},[],[292],{"type":44,"value":293},"yr check",{"type":44,"value":287},{"type":38,"tag":129,"props":296,"children":298},{"className":297},[],[299],{"type":44,"value":300},"yr fmt",{"type":44,"value":287},{"type":38,"tag":129,"props":303,"children":305},{"className":304},[],[306],{"type":44,"value":307},"yr dump",{"type":38,"tag":77,"props":309,"children":311},{"id":310},"platform-considerations",[312],{"type":44,"value":313},"Platform Considerations",{"type":38,"tag":47,"props":315,"children":316},{},[317],{"type":44,"value":318},"YARA works on any file type. Adapt patterns to your target:",{"type":38,"tag":320,"props":321,"children":322},"table",{},[323,352],{"type":38,"tag":324,"props":325,"children":326},"thead",{},[327],{"type":38,"tag":328,"props":329,"children":330},"tr",{},[331,337,342,347],{"type":38,"tag":332,"props":333,"children":334},"th",{},[335],{"type":44,"value":336},"Platform",{"type":38,"tag":332,"props":338,"children":339},{},[340],{"type":44,"value":341},"Magic Bytes",{"type":38,"tag":332,"props":343,"children":344},{},[345],{"type":44,"value":346},"Bad Strings",{"type":38,"tag":332,"props":348,"children":349},{},[350],{"type":44,"value":351},"Good Strings",{"type":38,"tag":353,"props":354,"children":355},"tbody",{},[356,387,435,479,515,545,574,608],{"type":38,"tag":328,"props":357,"children":358},{},[359,368,377,382],{"type":38,"tag":360,"props":361,"children":362},"td",{},[363],{"type":38,"tag":60,"props":364,"children":365},{},[366],{"type":44,"value":367},"Windows PE",{"type":38,"tag":360,"props":369,"children":370},{},[371],{"type":38,"tag":129,"props":372,"children":374},{"className":373},[],[375],{"type":44,"value":376},"uint16(0) == 0x5A4D",{"type":38,"tag":360,"props":378,"children":379},{},[380],{"type":44,"value":381},"API names, Windows paths",{"type":38,"tag":360,"props":383,"children":384},{},[385],{"type":44,"value":386},"Mutex names, PDB paths",{"type":38,"tag":328,"props":388,"children":389},{},[390,398,425,430],{"type":38,"tag":360,"props":391,"children":392},{},[393],{"type":38,"tag":60,"props":394,"children":395},{},[396],{"type":44,"value":397},"macOS Mach-O",{"type":38,"tag":360,"props":399,"children":400},{},[401,407,409,415,417,423],{"type":38,"tag":129,"props":402,"children":404},{"className":403},[],[405],{"type":44,"value":406},"uint32(0) == 0xFEEDFACE",{"type":44,"value":408}," (32-bit), ",{"type":38,"tag":129,"props":410,"children":412},{"className":411},[],[413],{"type":44,"value":414},"0xFEEDFACF",{"type":44,"value":416}," (64-bit), ",{"type":38,"tag":129,"props":418,"children":420},{"className":419},[],[421],{"type":44,"value":422},"0xCAFEBABE",{"type":44,"value":424}," (universal)",{"type":38,"tag":360,"props":426,"children":427},{},[428],{"type":44,"value":429},"Common Obj-C methods",{"type":38,"tag":360,"props":431,"children":432},{},[433],{"type":44,"value":434},"Keylogger strings, persistence paths",{"type":38,"tag":328,"props":436,"children":437},{},[438,446,451,474],{"type":38,"tag":360,"props":439,"children":440},{},[441],{"type":38,"tag":60,"props":442,"children":443},{},[444],{"type":44,"value":445},"JavaScript\u002FNode",{"type":38,"tag":360,"props":447,"children":448},{},[449],{"type":44,"value":450},"(none needed)",{"type":38,"tag":360,"props":452,"children":453},{},[454,460,461,467,468],{"type":38,"tag":129,"props":455,"children":457},{"className":456},[],[458],{"type":44,"value":459},"require",{"type":44,"value":287},{"type":38,"tag":129,"props":462,"children":464},{"className":463},[],[465],{"type":44,"value":466},"fetch",{"type":44,"value":287},{"type":38,"tag":129,"props":469,"children":471},{"className":470},[],[472],{"type":44,"value":473},"axios",{"type":38,"tag":360,"props":475,"children":476},{},[477],{"type":44,"value":478},"Obfuscator signatures, eval+decode chains",{"type":38,"tag":328,"props":480,"children":481},{},[482,490,494,510],{"type":38,"tag":360,"props":483,"children":484},{},[485],{"type":38,"tag":60,"props":486,"children":487},{},[488],{"type":44,"value":489},"npm\u002Fpip packages",{"type":38,"tag":360,"props":491,"children":492},{},[493],{"type":44,"value":450},{"type":38,"tag":360,"props":495,"children":496},{},[497,503,504],{"type":38,"tag":129,"props":498,"children":500},{"className":499},[],[501],{"type":44,"value":502},"postinstall",{"type":44,"value":287},{"type":38,"tag":129,"props":505,"children":507},{"className":506},[],[508],{"type":44,"value":509},"dependencies",{"type":38,"tag":360,"props":511,"children":512},{},[513],{"type":44,"value":514},"Suspicious package names, exfil URLs",{"type":38,"tag":328,"props":516,"children":517},{},[518,526,535,540],{"type":38,"tag":360,"props":519,"children":520},{},[521],{"type":38,"tag":60,"props":522,"children":523},{},[524],{"type":44,"value":525},"Office docs",{"type":38,"tag":360,"props":527,"children":528},{},[529],{"type":38,"tag":129,"props":530,"children":532},{"className":531},[],[533],{"type":44,"value":534},"uint32(0) == 0x504B0304",{"type":38,"tag":360,"props":536,"children":537},{},[538],{"type":44,"value":539},"VBA keywords",{"type":38,"tag":360,"props":541,"children":542},{},[543],{"type":44,"value":544},"Macro auto-exec, encoded payloads",{"type":38,"tag":328,"props":546,"children":547},{},[548,556,560,569],{"type":38,"tag":360,"props":549,"children":550},{},[551],{"type":38,"tag":60,"props":552,"children":553},{},[554],{"type":44,"value":555},"VS Code extensions",{"type":38,"tag":360,"props":557,"children":558},{},[559],{"type":44,"value":450},{"type":38,"tag":360,"props":561,"children":562},{},[563],{"type":38,"tag":129,"props":564,"children":566},{"className":565},[],[567],{"type":44,"value":568},"vscode.workspace",{"type":38,"tag":360,"props":570,"children":571},{},[572],{"type":44,"value":573},"Uncommon activationEvents, hidden file access",{"type":38,"tag":328,"props":575,"children":576},{},[577,585,598,603],{"type":38,"tag":360,"props":578,"children":579},{},[580],{"type":38,"tag":60,"props":581,"children":582},{},[583],{"type":44,"value":584},"Chrome extensions",{"type":38,"tag":360,"props":586,"children":587},{},[588,590,596],{"type":44,"value":589},"Use ",{"type":38,"tag":129,"props":591,"children":593},{"className":592},[],[594],{"type":44,"value":595},"crx",{"type":44,"value":597}," module",{"type":38,"tag":360,"props":599,"children":600},{},[601],{"type":44,"value":602},"Common Chrome APIs",{"type":38,"tag":360,"props":604,"children":605},{},[606],{"type":44,"value":607},"Permission abuse, manifest anomalies",{"type":38,"tag":328,"props":609,"children":610},{},[611,619,630,635],{"type":38,"tag":360,"props":612,"children":613},{},[614],{"type":38,"tag":60,"props":615,"children":616},{},[617],{"type":44,"value":618},"Android apps",{"type":38,"tag":360,"props":620,"children":621},{},[622,623,629],{"type":44,"value":589},{"type":38,"tag":129,"props":624,"children":626},{"className":625},[],[627],{"type":44,"value":628},"dex",{"type":44,"value":597},{"type":38,"tag":360,"props":631,"children":632},{},[633],{"type":44,"value":634},"Standard DEX structure",{"type":38,"tag":360,"props":636,"children":637},{},[638],{"type":44,"value":639},"Obfuscated classes, suspicious permissions",{"type":38,"tag":641,"props":642,"children":644},"h3",{"id":643},"macos-malware-detection",[645],{"type":44,"value":646},"macOS Malware Detection",{"type":38,"tag":47,"props":648,"children":649},{},[650],{"type":44,"value":651},"No dedicated Mach-O module exists yet. Use magic byte checks + string patterns:",{"type":38,"tag":47,"props":653,"children":654},{},[655],{"type":38,"tag":60,"props":656,"children":657},{},[658],{"type":44,"value":659},"Magic bytes:",{"type":38,"tag":661,"props":662,"children":667},"pre",{"className":663,"code":664,"language":665,"meta":666,"style":666},"language-yara shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","\u002F\u002F Mach-O 32-bit\nuint32(0) == 0xFEEDFACE\n\u002F\u002F Mach-O 64-bit\nuint32(0) == 0xFEEDFACF\n\u002F\u002F Universal binary (fat binary)\nuint32(0) == 0xCAFEBABE or uint32(0) == 0xBEBAFECA\n","yara","",[668],{"type":38,"tag":129,"props":669,"children":670},{"__ignoreMap":666},[671,682,691,700,709,718],{"type":38,"tag":672,"props":673,"children":676},"span",{"class":674,"line":675},"line",1,[677],{"type":38,"tag":672,"props":678,"children":679},{},[680],{"type":44,"value":681},"\u002F\u002F Mach-O 32-bit\n",{"type":38,"tag":672,"props":683,"children":685},{"class":674,"line":684},2,[686],{"type":38,"tag":672,"props":687,"children":688},{},[689],{"type":44,"value":690},"uint32(0) == 0xFEEDFACE\n",{"type":38,"tag":672,"props":692,"children":694},{"class":674,"line":693},3,[695],{"type":38,"tag":672,"props":696,"children":697},{},[698],{"type":44,"value":699},"\u002F\u002F Mach-O 64-bit\n",{"type":38,"tag":672,"props":701,"children":703},{"class":674,"line":702},4,[704],{"type":38,"tag":672,"props":705,"children":706},{},[707],{"type":44,"value":708},"uint32(0) == 0xFEEDFACF\n",{"type":38,"tag":672,"props":710,"children":712},{"class":674,"line":711},5,[713],{"type":38,"tag":672,"props":714,"children":715},{},[716],{"type":44,"value":717},"\u002F\u002F Universal binary (fat binary)\n",{"type":38,"tag":672,"props":719,"children":721},{"class":674,"line":720},6,[722],{"type":38,"tag":672,"props":723,"children":724},{},[725],{"type":44,"value":726},"uint32(0) == 0xCAFEBABE or uint32(0) == 0xBEBAFECA\n",{"type":38,"tag":47,"props":728,"children":729},{},[730],{"type":38,"tag":60,"props":731,"children":732},{},[733],{"type":44,"value":734},"Good indicators for macOS malware:",{"type":38,"tag":154,"props":736,"children":737},{},[738,756,781,799],{"type":38,"tag":88,"props":739,"children":740},{},[741,743,749,750],{"type":44,"value":742},"Keylogger artifacts: ",{"type":38,"tag":129,"props":744,"children":746},{"className":745},[],[747],{"type":44,"value":748},"CGEventTapCreate",{"type":44,"value":287},{"type":38,"tag":129,"props":751,"children":753},{"className":752},[],[754],{"type":44,"value":755},"kCGEventKeyDown",{"type":38,"tag":88,"props":757,"children":758},{},[759,761,767,768,774,775],{"type":44,"value":760},"SSH tunnel strings: ",{"type":38,"tag":129,"props":762,"children":764},{"className":763},[],[765],{"type":44,"value":766},"ssh -D",{"type":44,"value":287},{"type":38,"tag":129,"props":769,"children":771},{"className":770},[],[772],{"type":44,"value":773},"tunnel",{"type":44,"value":287},{"type":38,"tag":129,"props":776,"children":778},{"className":777},[],[779],{"type":44,"value":780},"socks",{"type":38,"tag":88,"props":782,"children":783},{},[784,786,792,793],{"type":44,"value":785},"Persistence paths: ",{"type":38,"tag":129,"props":787,"children":789},{"className":788},[],[790],{"type":44,"value":791},"~\u002FLibrary\u002FLaunchAgents",{"type":44,"value":287},{"type":38,"tag":129,"props":794,"children":796},{"className":795},[],[797],{"type":44,"value":798},"\u002FLibrary\u002FLaunchDaemons",{"type":38,"tag":88,"props":800,"children":801},{},[802,804,810,811],{"type":44,"value":803},"Credential theft: ",{"type":38,"tag":129,"props":805,"children":807},{"className":806},[],[808],{"type":44,"value":809},"security find-generic-password",{"type":44,"value":287},{"type":38,"tag":129,"props":812,"children":814},{"className":813},[],[815],{"type":44,"value":816},"keychain",{"type":38,"tag":47,"props":818,"children":819},{},[820],{"type":38,"tag":60,"props":821,"children":822},{},[823],{"type":44,"value":824},"Example pattern from Airbnb BinaryAlert:",{"type":38,"tag":661,"props":826,"children":828},{"className":663,"code":827,"language":665,"meta":666,"style":666},"rule SUSP_Mac_ProtonRAT\n{\n    strings:\n        \u002F\u002F Library indicators\n        $lib1 = \"SRWebSocket\" ascii\n        $lib2 = \"SocketRocket\" ascii\n\n        \u002F\u002F Behavioral indicators\n        $behav1 = \"SSH tunnel not launched\" ascii\n        $behav2 = \"Keylogger\" ascii\n\n    condition:\n        (uint32(0) == 0xFEEDFACF or uint32(0) == 0xCAFEBABE) and\n        any of ($lib*) and any of ($behav*)\n}\n",[829],{"type":38,"tag":129,"props":830,"children":831},{"__ignoreMap":666},[832,840,848,856,864,872,880,890,899,908,917,925,934,943,952],{"type":38,"tag":672,"props":833,"children":834},{"class":674,"line":675},[835],{"type":38,"tag":672,"props":836,"children":837},{},[838],{"type":44,"value":839},"rule SUSP_Mac_ProtonRAT\n",{"type":38,"tag":672,"props":841,"children":842},{"class":674,"line":684},[843],{"type":38,"tag":672,"props":844,"children":845},{},[846],{"type":44,"value":847},"{\n",{"type":38,"tag":672,"props":849,"children":850},{"class":674,"line":693},[851],{"type":38,"tag":672,"props":852,"children":853},{},[854],{"type":44,"value":855},"    strings:\n",{"type":38,"tag":672,"props":857,"children":858},{"class":674,"line":702},[859],{"type":38,"tag":672,"props":860,"children":861},{},[862],{"type":44,"value":863},"        \u002F\u002F Library indicators\n",{"type":38,"tag":672,"props":865,"children":866},{"class":674,"line":711},[867],{"type":38,"tag":672,"props":868,"children":869},{},[870],{"type":44,"value":871},"        $lib1 = \"SRWebSocket\" ascii\n",{"type":38,"tag":672,"props":873,"children":874},{"class":674,"line":720},[875],{"type":38,"tag":672,"props":876,"children":877},{},[878],{"type":44,"value":879},"        $lib2 = \"SocketRocket\" ascii\n",{"type":38,"tag":672,"props":881,"children":883},{"class":674,"line":882},7,[884],{"type":38,"tag":672,"props":885,"children":887},{"emptyLinePlaceholder":886},true,[888],{"type":44,"value":889},"\n",{"type":38,"tag":672,"props":891,"children":893},{"class":674,"line":892},8,[894],{"type":38,"tag":672,"props":895,"children":896},{},[897],{"type":44,"value":898},"        \u002F\u002F Behavioral indicators\n",{"type":38,"tag":672,"props":900,"children":902},{"class":674,"line":901},9,[903],{"type":38,"tag":672,"props":904,"children":905},{},[906],{"type":44,"value":907},"        $behav1 = \"SSH tunnel not launched\" ascii\n",{"type":38,"tag":672,"props":909,"children":911},{"class":674,"line":910},10,[912],{"type":38,"tag":672,"props":913,"children":914},{},[915],{"type":44,"value":916},"        $behav2 = \"Keylogger\" ascii\n",{"type":38,"tag":672,"props":918,"children":920},{"class":674,"line":919},11,[921],{"type":38,"tag":672,"props":922,"children":923},{"emptyLinePlaceholder":886},[924],{"type":44,"value":889},{"type":38,"tag":672,"props":926,"children":928},{"class":674,"line":927},12,[929],{"type":38,"tag":672,"props":930,"children":931},{},[932],{"type":44,"value":933},"    condition:\n",{"type":38,"tag":672,"props":935,"children":937},{"class":674,"line":936},13,[938],{"type":38,"tag":672,"props":939,"children":940},{},[941],{"type":44,"value":942},"        (uint32(0) == 0xFEEDFACF or uint32(0) == 0xCAFEBABE) and\n",{"type":38,"tag":672,"props":944,"children":946},{"class":674,"line":945},14,[947],{"type":38,"tag":672,"props":948,"children":949},{},[950],{"type":44,"value":951},"        any of ($lib*) and any of ($behav*)\n",{"type":38,"tag":672,"props":953,"children":955},{"class":674,"line":954},15,[956],{"type":38,"tag":672,"props":957,"children":958},{},[959],{"type":44,"value":960},"}\n",{"type":38,"tag":641,"props":962,"children":964},{"id":963},"javascript-detection-decision-tree",[965],{"type":44,"value":966},"JavaScript Detection Decision Tree",{"type":38,"tag":661,"props":968,"children":972},{"className":969,"code":971,"language":44},[970],"language-text","Writing a JavaScript rule?\n├─ npm package?\n│  ├─ Check package.json patterns\n│  ├─ Look for postinstall\u002Fpreinstall hooks\n│  └─ Target exfil patterns: fetch + env access + credential paths\n├─ Browser extension?\n│  ├─ Chrome: Use crx module\n│  └─ Others: Target manifest patterns, background script behaviors\n├─ Standalone JS file?\n│  ├─ Look for obfuscation markers: eval+atob, fromCharCode chains\n│  ├─ Target unique function\u002Fvariable names (often survive minification)\n│  └─ Check for packed\u002Fencoded payloads\n└─ Minified\u002Fwebpack bundle?\n   ├─ Target unique strings that survive bundling (URLs, magic values)\n   └─ Avoid function names (will be mangled)\n",[973],{"type":38,"tag":129,"props":974,"children":975},{"__ignoreMap":666},[976],{"type":44,"value":971},{"type":38,"tag":47,"props":978,"children":979},{},[980],{"type":38,"tag":60,"props":981,"children":982},{},[983],{"type":44,"value":984},"JavaScript-specific good strings:",{"type":38,"tag":154,"props":986,"children":987},{},[988,1001,1012,1030],{"type":38,"tag":88,"props":989,"children":990},{},[991,993,999],{"type":44,"value":992},"Ethereum function selectors: ",{"type":38,"tag":129,"props":994,"children":996},{"className":995},[],[997],{"type":44,"value":998},"{ 70 a0 82 31 }",{"type":44,"value":1000}," (transfer)",{"type":38,"tag":88,"props":1002,"children":1003},{},[1004,1006],{"type":44,"value":1005},"Zero-width characters (steganography): ",{"type":38,"tag":129,"props":1007,"children":1009},{"className":1008},[],[1010],{"type":44,"value":1011},"{ E2 80 8B E2 80 8C }",{"type":38,"tag":88,"props":1013,"children":1014},{},[1015,1017,1023,1024],{"type":44,"value":1016},"Obfuscator signatures: ",{"type":38,"tag":129,"props":1018,"children":1020},{"className":1019},[],[1021],{"type":44,"value":1022},"_0x",{"type":44,"value":287},{"type":38,"tag":129,"props":1025,"children":1027},{"className":1026},[],[1028],{"type":44,"value":1029},"var _0x",{"type":38,"tag":88,"props":1031,"children":1032},{},[1033],{"type":44,"value":1034},"Specific C2 patterns: domain names, webhook URLs",{"type":38,"tag":47,"props":1036,"children":1037},{},[1038],{"type":38,"tag":60,"props":1039,"children":1040},{},[1041],{"type":44,"value":1042},"JavaScript-specific bad strings:",{"type":38,"tag":154,"props":1044,"children":1045},{},[1046,1068,1086],{"type":38,"tag":88,"props":1047,"children":1048},{},[1049,1054,1055,1060,1061,1066],{"type":38,"tag":129,"props":1050,"children":1052},{"className":1051},[],[1053],{"type":44,"value":459},{"type":44,"value":287},{"type":38,"tag":129,"props":1056,"children":1058},{"className":1057},[],[1059],{"type":44,"value":466},{"type":44,"value":287},{"type":38,"tag":129,"props":1062,"children":1064},{"className":1063},[],[1065],{"type":44,"value":473},{"type":44,"value":1067}," — too common",{"type":38,"tag":88,"props":1069,"children":1070},{},[1071,1077,1078,1084],{"type":38,"tag":129,"props":1072,"children":1074},{"className":1073},[],[1075],{"type":44,"value":1076},"Buffer",{"type":44,"value":287},{"type":38,"tag":129,"props":1079,"children":1081},{"className":1080},[],[1082],{"type":44,"value":1083},"crypto",{"type":44,"value":1085}," — legitimate uses everywhere",{"type":38,"tag":88,"props":1087,"children":1088},{},[1089,1095],{"type":38,"tag":129,"props":1090,"children":1092},{"className":1091},[],[1093],{"type":44,"value":1094},"process.env",{"type":44,"value":1096}," alone — need specific env var names",{"type":38,"tag":77,"props":1098,"children":1100},{"id":1099},"essential-toolkit",[1101],{"type":44,"value":1102},"Essential Toolkit",{"type":38,"tag":320,"props":1104,"children":1105},{},[1106,1122],{"type":38,"tag":324,"props":1107,"children":1108},{},[1109],{"type":38,"tag":328,"props":1110,"children":1111},{},[1112,1117],{"type":38,"tag":332,"props":1113,"children":1114},{},[1115],{"type":44,"value":1116},"Tool",{"type":38,"tag":332,"props":1118,"children":1119},{},[1120],{"type":44,"value":1121},"Purpose",{"type":38,"tag":353,"props":1123,"children":1124},{},[1125,1154,1178,1215,1231],{"type":38,"tag":328,"props":1126,"children":1127},{},[1128,1136],{"type":38,"tag":360,"props":1129,"children":1130},{},[1131],{"type":38,"tag":60,"props":1132,"children":1133},{},[1134],{"type":44,"value":1135},"yarGen",{"type":38,"tag":360,"props":1137,"children":1138},{},[1139,1141,1147,1149],{"type":44,"value":1140},"Extract candidate strings: ",{"type":38,"tag":129,"props":1142,"children":1144},{"className":1143},[],[1145],{"type":44,"value":1146},"yarGen.py -m samples\u002F --excludegood",{"type":44,"value":1148}," → validate with ",{"type":38,"tag":129,"props":1150,"children":1152},{"className":1151},[],[1153],{"type":44,"value":293},{"type":38,"tag":328,"props":1155,"children":1156},{},[1157,1165],{"type":38,"tag":360,"props":1158,"children":1159},{},[1160],{"type":38,"tag":60,"props":1161,"children":1162},{},[1163],{"type":44,"value":1164},"FLOSS",{"type":38,"tag":360,"props":1166,"children":1167},{},[1168,1170,1176],{"type":44,"value":1169},"Extract obfuscated\u002Fstack strings: ",{"type":38,"tag":129,"props":1171,"children":1173},{"className":1172},[],[1174],{"type":44,"value":1175},"floss sample.exe",{"type":44,"value":1177}," (when yarGen fails)",{"type":38,"tag":328,"props":1179,"children":1180},{},[1181,1189],{"type":38,"tag":360,"props":1182,"children":1183},{},[1184],{"type":38,"tag":60,"props":1185,"children":1186},{},[1187],{"type":44,"value":1188},"yr CLI",{"type":38,"tag":360,"props":1190,"children":1191},{},[1192,1194,1199,1201,1207,1209],{"type":44,"value":1193},"Validate: ",{"type":38,"tag":129,"props":1195,"children":1197},{"className":1196},[],[1198],{"type":44,"value":293},{"type":44,"value":1200},", scan: ",{"type":38,"tag":129,"props":1202,"children":1204},{"className":1203},[],[1205],{"type":44,"value":1206},"yr scan -s",{"type":44,"value":1208},", inspect: ",{"type":38,"tag":129,"props":1210,"children":1212},{"className":1211},[],[1213],{"type":44,"value":1214},"yr dump -m pe",{"type":38,"tag":328,"props":1216,"children":1217},{},[1218,1226],{"type":38,"tag":360,"props":1219,"children":1220},{},[1221],{"type":38,"tag":60,"props":1222,"children":1223},{},[1224],{"type":44,"value":1225},"signature-base",{"type":38,"tag":360,"props":1227,"children":1228},{},[1229],{"type":44,"value":1230},"Study quality examples",{"type":38,"tag":328,"props":1232,"children":1233},{},[1234,1242],{"type":38,"tag":360,"props":1235,"children":1236},{},[1237],{"type":38,"tag":60,"props":1238,"children":1239},{},[1240],{"type":44,"value":1241},"YARA-CI",{"type":38,"tag":360,"props":1243,"children":1244},{},[1245],{"type":44,"value":1246},"Goodware corpus testing before deployment",{"type":38,"tag":47,"props":1248,"children":1249},{},[1250],{"type":44,"value":1251},"Master these five. Don't get distracted by tool catalogs.",{"type":38,"tag":77,"props":1253,"children":1255},{"id":1254},"rationalizations-to-reject",[1256],{"type":44,"value":1257},"Rationalizations to Reject",{"type":38,"tag":47,"props":1259,"children":1260},{},[1261],{"type":44,"value":1262},"When you catch yourself thinking these, stop and reconsider.",{"type":38,"tag":320,"props":1264,"children":1265},{},[1266,1282],{"type":38,"tag":324,"props":1267,"children":1268},{},[1269],{"type":38,"tag":328,"props":1270,"children":1271},{},[1272,1277],{"type":38,"tag":332,"props":1273,"children":1274},{},[1275],{"type":44,"value":1276},"Rationalization",{"type":38,"tag":332,"props":1278,"children":1279},{},[1280],{"type":44,"value":1281},"Expert Response",{"type":38,"tag":353,"props":1283,"children":1284},{},[1285,1298,1311,1324,1337,1350,1363,1376,1389,1402,1415,1428,1449,1468,1481,1502],{"type":38,"tag":328,"props":1286,"children":1287},{},[1288,1293],{"type":38,"tag":360,"props":1289,"children":1290},{},[1291],{"type":44,"value":1292},"\"This generic string is unique enough\"",{"type":38,"tag":360,"props":1294,"children":1295},{},[1296],{"type":44,"value":1297},"Test against goodware first. Your intuition is wrong.",{"type":38,"tag":328,"props":1299,"children":1300},{},[1301,1306],{"type":38,"tag":360,"props":1302,"children":1303},{},[1304],{"type":44,"value":1305},"\"yarGen gave me these strings\"",{"type":38,"tag":360,"props":1307,"children":1308},{},[1309],{"type":44,"value":1310},"yarGen suggests, you validate. Check each one manually.",{"type":38,"tag":328,"props":1312,"children":1313},{},[1314,1319],{"type":38,"tag":360,"props":1315,"children":1316},{},[1317],{"type":44,"value":1318},"\"It works on my 10 samples\"",{"type":38,"tag":360,"props":1320,"children":1321},{},[1322],{"type":44,"value":1323},"10 samples ≠ production. Use VirusTotal goodware corpus.",{"type":38,"tag":328,"props":1325,"children":1326},{},[1327,1332],{"type":38,"tag":360,"props":1328,"children":1329},{},[1330],{"type":44,"value":1331},"\"One rule to catch all variants\"",{"type":38,"tag":360,"props":1333,"children":1334},{},[1335],{"type":44,"value":1336},"Causes FP floods. Target specific families.",{"type":38,"tag":328,"props":1338,"children":1339},{},[1340,1345],{"type":38,"tag":360,"props":1341,"children":1342},{},[1343],{"type":44,"value":1344},"\"I'll make it more specific if we get FPs\"",{"type":38,"tag":360,"props":1346,"children":1347},{},[1348],{"type":44,"value":1349},"Write tight rules upfront. FPs burn trust.",{"type":38,"tag":328,"props":1351,"children":1352},{},[1353,1358],{"type":38,"tag":360,"props":1354,"children":1355},{},[1356],{"type":44,"value":1357},"\"This hex pattern is unique\"",{"type":38,"tag":360,"props":1359,"children":1360},{},[1361],{"type":44,"value":1362},"Unique in one sample ≠ unique across malware ecosystem.",{"type":38,"tag":328,"props":1364,"children":1365},{},[1366,1371],{"type":38,"tag":360,"props":1367,"children":1368},{},[1369],{"type":44,"value":1370},"\"Performance doesn't matter\"",{"type":38,"tag":360,"props":1372,"children":1373},{},[1374],{"type":44,"value":1375},"One slow rule slows entire ruleset. Optimize atoms.",{"type":38,"tag":328,"props":1377,"children":1378},{},[1379,1384],{"type":38,"tag":360,"props":1380,"children":1381},{},[1382],{"type":44,"value":1383},"\"PEiD rules still work\"",{"type":38,"tag":360,"props":1385,"children":1386},{},[1387],{"type":44,"value":1388},"Obsolete. 32-bit packers aren't relevant.",{"type":38,"tag":328,"props":1390,"children":1391},{},[1392,1397],{"type":38,"tag":360,"props":1393,"children":1394},{},[1395],{"type":44,"value":1396},"\"I'll add more conditions later\"",{"type":38,"tag":360,"props":1398,"children":1399},{},[1400],{"type":44,"value":1401},"Weak rules deployed = damage done.",{"type":38,"tag":328,"props":1403,"children":1404},{},[1405,1410],{"type":38,"tag":360,"props":1406,"children":1407},{},[1408],{"type":44,"value":1409},"\"This is just for hunting\"",{"type":38,"tag":360,"props":1411,"children":1412},{},[1413],{"type":44,"value":1414},"Hunting rules become detection rules. Same quality bar.",{"type":38,"tag":328,"props":1416,"children":1417},{},[1418,1423],{"type":38,"tag":360,"props":1419,"children":1420},{},[1421],{"type":44,"value":1422},"\"The API name makes it malicious\"",{"type":38,"tag":360,"props":1424,"children":1425},{},[1426],{"type":44,"value":1427},"Legitimate software uses same APIs. Need behavioral context.",{"type":38,"tag":328,"props":1429,"children":1430},{},[1431,1436],{"type":38,"tag":360,"props":1432,"children":1433},{},[1434],{"type":44,"value":1435},"\"any of them is fine for these common strings\"",{"type":38,"tag":360,"props":1437,"children":1438},{},[1439,1441,1447],{"type":44,"value":1440},"Common strings + any = FP flood. Use ",{"type":38,"tag":129,"props":1442,"children":1444},{"className":1443},[],[1445],{"type":44,"value":1446},"any of",{"type":44,"value":1448}," only for individually unique strings.",{"type":38,"tag":328,"props":1450,"children":1451},{},[1452,1457],{"type":38,"tag":360,"props":1453,"children":1454},{},[1455],{"type":44,"value":1456},"\"This regex is specific enough\"",{"type":38,"tag":360,"props":1458,"children":1459},{},[1460,1466],{"type":38,"tag":129,"props":1461,"children":1463},{"className":1462},[],[1464],{"type":44,"value":1465},"\u002Ffetch.*token\u002F",{"type":44,"value":1467}," matches all auth code. Add exfil destination requirement.",{"type":38,"tag":328,"props":1469,"children":1470},{},[1471,1476],{"type":38,"tag":360,"props":1472,"children":1473},{},[1474],{"type":44,"value":1475},"\"The JavaScript looks clean\"",{"type":38,"tag":360,"props":1477,"children":1478},{},[1479],{"type":44,"value":1480},"Attackers poison legitimate code with injects. Check for eval+decode chains.",{"type":38,"tag":328,"props":1482,"children":1483},{},[1484,1489],{"type":38,"tag":360,"props":1485,"children":1486},{},[1487],{"type":44,"value":1488},"\"I'll use .* for flexibility\"",{"type":38,"tag":360,"props":1490,"children":1491},{},[1492,1494,1500],{"type":44,"value":1493},"Unbounded regex = performance disaster + memory explosion. Use ",{"type":38,"tag":129,"props":1495,"children":1497},{"className":1496},[],[1498],{"type":44,"value":1499},".{0,30}",{"type":44,"value":1501},".",{"type":38,"tag":328,"props":1503,"children":1504},{},[1505,1510],{"type":38,"tag":360,"props":1506,"children":1507},{},[1508],{"type":44,"value":1509},"\"I'll use --relaxed-re-syntax everywhere\"",{"type":38,"tag":360,"props":1511,"children":1512},{},[1513],{"type":44,"value":1514},"Masks real bugs. Fix the regex instead of hiding problems.",{"type":38,"tag":77,"props":1516,"children":1518},{"id":1517},"decision-trees",[1519],{"type":44,"value":1520},"Decision Trees",{"type":38,"tag":641,"props":1522,"children":1524},{"id":1523},"is-this-string-good-enough",[1525],{"type":44,"value":1526},"Is This String Good Enough?",{"type":38,"tag":661,"props":1528,"children":1531},{"className":1529,"code":1530,"language":44},[970],"Is this string good enough?\n├─ Less than 4 bytes?\n│  └─ NO — find longer string\n├─ Contains repeated bytes (0000, 9090)?\n│  └─ NO — add surrounding context\n├─ Is an API name (VirtualAlloc, CreateRemoteThread)?\n│  └─ NO — use hex pattern of call site instead\n├─ Appears in Windows system files?\n│  └─ NO — too generic, find something unique\n├─ Is it a common path (C:\\Windows\\, cmd.exe)?\n│  └─ NO — find malware-specific paths\n├─ Unique to this malware family?\n│  └─ YES — use it\n└─ Appears in other malware too?\n   └─ MAYBE — combine with family-specific marker\n",[1532],{"type":38,"tag":129,"props":1533,"children":1534},{"__ignoreMap":666},[1535],{"type":44,"value":1530},{"type":38,"tag":641,"props":1537,"children":1539},{"id":1538},"when-to-use-all-of-vs-any-of",[1540],{"type":44,"value":1541},"When to Use \"all of\" vs \"any of\"",{"type":38,"tag":661,"props":1543,"children":1546},{"className":1544,"code":1545,"language":44},[970],"Should I require all strings or allow any?\n├─ Strings are individually unique to malware?\n│  └─ any of them (each alone is suspicious)\n├─ Strings are common but combination is suspicious?\n│  └─ all of them (require the full pattern)\n├─ Strings have different confidence levels?\n│  └─ Group: all of ($core_*) and any of ($variant_*)\n└─ Seeing many false positives?\n   └─ Tighten: switch any → all, add more required strings\n",[1547],{"type":38,"tag":129,"props":1548,"children":1549},{"__ignoreMap":666},[1550],{"type":44,"value":1545},{"type":38,"tag":47,"props":1552,"children":1553},{},[1554,1559,1561,1567],{"type":38,"tag":60,"props":1555,"children":1556},{},[1557],{"type":44,"value":1558},"Lesson from production:",{"type":44,"value":1560}," Rules using ",{"type":38,"tag":129,"props":1562,"children":1564},{"className":1563},[],[1565],{"type":44,"value":1566},"any of ($network_*)",{"type":44,"value":1568}," where strings included \"fetch\", \"axios\", \"http\" matched virtually all web applications. Switching to require credential path AND network call AND exfil destination eliminated FPs.",{"type":38,"tag":641,"props":1570,"children":1572},{"id":1571},"when-to-abandon-a-rule-approach",[1573],{"type":44,"value":1574},"When to Abandon a Rule Approach",{"type":38,"tag":47,"props":1576,"children":1577},{},[1578],{"type":44,"value":1579},"Stop and pivot when:",{"type":38,"tag":154,"props":1581,"children":1582},{},[1583,1599,1609,1619,1629],{"type":38,"tag":88,"props":1584,"children":1585},{},[1586,1591,1593],{"type":38,"tag":60,"props":1587,"children":1588},{},[1589],{"type":44,"value":1590},"yarGen returns only API names and paths",{"type":44,"value":1592}," → See ",{"type":38,"tag":68,"props":1594,"children":1596},{"href":1595},"#when-strings-fail-pivot-to-structure",[1597],{"type":44,"value":1598},"When Strings Fail, Pivot to Structure",{"type":38,"tag":88,"props":1600,"children":1601},{},[1602,1607],{"type":38,"tag":60,"props":1603,"children":1604},{},[1605],{"type":44,"value":1606},"Can't find 3 unique strings",{"type":44,"value":1608}," → Probably packed. Target the unpacked version or detect the packer.",{"type":38,"tag":88,"props":1610,"children":1611},{},[1612,1617],{"type":38,"tag":60,"props":1613,"children":1614},{},[1615],{"type":44,"value":1616},"Rule matches goodware files",{"type":44,"value":1618}," → Strings aren't unique enough. 1-2 matches = investigate and tighten; 3-5 matches = find different indicators; 6+ matches = start over.",{"type":38,"tag":88,"props":1620,"children":1621},{},[1622,1627],{"type":38,"tag":60,"props":1623,"children":1624},{},[1625],{"type":44,"value":1626},"Performance is terrible even after optimization",{"type":44,"value":1628}," → Architecture problem. Split into multiple focused rules or add strict pre-filters.",{"type":38,"tag":88,"props":1630,"children":1631},{},[1632,1637],{"type":38,"tag":60,"props":1633,"children":1634},{},[1635],{"type":44,"value":1636},"Description is hard to write",{"type":44,"value":1638}," → The rule is too vague. If you can't explain what it catches, it catches too much.",{"type":38,"tag":641,"props":1640,"children":1642},{"id":1641},"debugging-false-positives",[1643],{"type":44,"value":1644},"Debugging False Positives",{"type":38,"tag":661,"props":1646,"children":1649},{"className":1647,"code":1648,"language":44},[970],"FP Investigation Flow:\n│\n├─ 1. Which string matched?\n│     Run: yr scan -s rule.yar false_positive.exe\n│\n├─ 2. Is it in a legitimate library?\n│     └─ Add: not $fp_vendor_string exclusion\n│\n├─ 3. Is it a common development pattern?\n│     └─ Find more specific indicator, replace the string\n│\n├─ 4. Are multiple generic strings matching together?\n│     └─ Tighten to require all + add unique marker\n│\n└─ 5. Is the malware using common techniques?\n      └─ Target malware-specific implementation details, not the technique\n",[1650],{"type":38,"tag":129,"props":1651,"children":1652},{"__ignoreMap":666},[1653],{"type":44,"value":1648},{"type":38,"tag":641,"props":1655,"children":1657},{"id":1656},"hex-vs-text-vs-regex",[1658],{"type":44,"value":1659},"Hex vs Text vs Regex",{"type":38,"tag":661,"props":1661,"children":1664},{"className":1662,"code":1663,"language":44},[970],"What string type should I use?\n│\n├─ Exact ASCII\u002FUnicode text?\n│  └─ TEXT: $s = \"MutexName\" ascii wide\n│\n├─ Specific byte sequence?\n│  └─ HEX: $h = { 4D 5A 90 00 }\n│\n├─ Byte sequence with variation?\n│  └─ HEX with wildcards: { 4D 5A ?? ?? 50 45 }\n│\n├─ Pattern with structure (URLs, paths)?\n│  └─ BOUNDED REGEX: \u002Fhttps:\\\u002F\\\u002F[a-z]{5,20}\\.onion\u002F\n│\n└─ Unknown encoding (XOR, base64)?\n   └─ TEXT with modifier: $s = \"config\" xor(0x00-0xFF)\n",[1665],{"type":38,"tag":129,"props":1666,"children":1667},{"__ignoreMap":666},[1668],{"type":44,"value":1663},{"type":38,"tag":641,"props":1670,"children":1672},{"id":1671},"is-the-sample-packed-check-first",[1673],{"type":44,"value":1674},"Is the Sample Packed? (Check First)",{"type":38,"tag":47,"props":1676,"children":1677},{},[1678],{"type":44,"value":1679},"Before writing any string-based rule:",{"type":38,"tag":661,"props":1681,"children":1684},{"className":1682,"code":1683,"language":44},[970],"Is the sample packed?\n├─ Entropy > 7.0?\n│  └─ Likely packed — find unpacked layer first\n├─ Few\u002Fno readable strings?\n│  └─ Likely packed — use entropy, PE structure, or packer signatures\n├─ UPX\u002FMPRESS\u002Fcustom packer detected?\n│  └─ Target the unpacked payload OR detect the packer itself\n└─ Readable strings available?\n   └─ Proceed with string-based detection\n",[1685],{"type":38,"tag":129,"props":1686,"children":1687},{"__ignoreMap":666},[1688],{"type":44,"value":1683},{"type":38,"tag":47,"props":1690,"children":1691},{},[1692,1697],{"type":38,"tag":60,"props":1693,"children":1694},{},[1695],{"type":44,"value":1696},"Expert guidance:",{"type":44,"value":1698}," Don't write rules against packed layers. The packing changes; the payload doesn't.",{"type":38,"tag":641,"props":1700,"children":1702},{"id":1701},"when-strings-fail-pivot-to-structure",[1703],{"type":44,"value":1598},{"type":38,"tag":47,"props":1705,"children":1706},{},[1707],{"type":44,"value":1708},"If yarGen returns only API names and generic paths:",{"type":38,"tag":661,"props":1710,"children":1713},{"className":1711,"code":1712,"language":44},[970],"String extraction failed — what now?\n├─ High entropy sections?\n│  └─ Use math.entropy() on specific sections\n├─ Unusual imports pattern?\n│  └─ Use pe.imphash() for import hash clustering\n├─ Consistent PE structure anomalies?\n│  └─ Target section names, sizes, characteristics\n├─ Metadata present?\n│  └─ Target version info, timestamps, resources\n└─ Nothing unique?\n   └─ This sample may not be detectable with YARA alone\n",[1714],{"type":38,"tag":129,"props":1715,"children":1716},{"__ignoreMap":666},[1717],{"type":44,"value":1712},{"type":38,"tag":47,"props":1719,"children":1720},{},[1721,1725],{"type":38,"tag":60,"props":1722,"children":1723},{},[1724],{"type":44,"value":1696},{"type":44,"value":1726}," \"One can try to use other file properties, such as metadata, entropy, import hashes or other data which stays constant.\" — Kaspersky Applied YARA Training",{"type":38,"tag":77,"props":1728,"children":1730},{"id":1729},"expert-heuristics",[1731],{"type":44,"value":1732},"Expert Heuristics",{"type":38,"tag":47,"props":1734,"children":1735},{},[1736,1741],{"type":38,"tag":60,"props":1737,"children":1738},{},[1739],{"type":44,"value":1740},"String selection:",{"type":44,"value":1742}," Mutex names are gold; C2 paths silver; error messages bronze. Stack strings are almost always unique. If you need >6 strings, you're over-fitting.",{"type":38,"tag":47,"props":1744,"children":1745},{},[1746,1751,1753,1759],{"type":38,"tag":60,"props":1747,"children":1748},{},[1749],{"type":44,"value":1750},"Condition design:",{"type":44,"value":1752}," Start with ",{"type":38,"tag":129,"props":1754,"children":1756},{"className":1755},[],[1757],{"type":44,"value":1758},"filesize \u003C",{"type":44,"value":1760},", then magic bytes, then strings, then modules. If >5 lines, split into multiple rules.",{"type":38,"tag":47,"props":1762,"children":1763},{},[1764,1769],{"type":38,"tag":60,"props":1765,"children":1766},{},[1767],{"type":44,"value":1768},"Quality signals:",{"type":44,"value":1770}," yarGen output needs 80% filtering. Rules matching \u003C50% of variants are too narrow; matching goodware are too broad.",{"type":38,"tag":47,"props":1772,"children":1773},{},[1774],{"type":38,"tag":60,"props":1775,"children":1776},{},[1777],{"type":44,"value":1778},"Modifier discipline:",{"type":38,"tag":154,"props":1780,"children":1781},{},[1782,1808,1825],{"type":38,"tag":88,"props":1783,"children":1784},{},[1785,1806],{"type":38,"tag":60,"props":1786,"children":1787},{},[1788,1790,1796,1798,1804],{"type":44,"value":1789},"Never use ",{"type":38,"tag":129,"props":1791,"children":1793},{"className":1792},[],[1794],{"type":44,"value":1795},"nocase",{"type":44,"value":1797}," or ",{"type":38,"tag":129,"props":1799,"children":1801},{"className":1800},[],[1802],{"type":44,"value":1803},"wide",{"type":44,"value":1805}," speculatively",{"type":44,"value":1807}," — only when you have confirmed evidence the case\u002Fencoding varies in samples",{"type":38,"tag":88,"props":1809,"children":1810},{},[1811,1816,1818,1823],{"type":38,"tag":129,"props":1812,"children":1814},{"className":1813},[],[1815],{"type":44,"value":1795},{"type":44,"value":1817}," doubles atom generation; ",{"type":38,"tag":129,"props":1819,"children":1821},{"className":1820},[],[1822],{"type":44,"value":1803},{"type":44,"value":1824}," doubles string matching — both have real costs",{"type":38,"tag":88,"props":1826,"children":1827},{},[1828],{"type":44,"value":1829},"\"If you don't have a clear reason for using those modifiers, don't do it\" — Kaspersky Applied YARA",{"type":38,"tag":47,"props":1831,"children":1832},{},[1833],{"type":38,"tag":60,"props":1834,"children":1835},{},[1836],{"type":44,"value":1837},"Regex anchoring:",{"type":38,"tag":154,"props":1839,"children":1840},{},[1841,1853,1872],{"type":38,"tag":88,"props":1842,"children":1843},{},[1844,1846,1851],{"type":44,"value":1845},"Regex without a 4+ byte literal substring ",{"type":38,"tag":60,"props":1847,"children":1848},{},[1849],{"type":44,"value":1850},"evaluates at every file offset",{"type":44,"value":1852}," — catastrophic performance",{"type":38,"tag":88,"props":1854,"children":1855},{},[1856,1858,1864,1866],{"type":44,"value":1857},"Always anchor regex to a distinctive literal: ",{"type":38,"tag":129,"props":1859,"children":1861},{"className":1860},[],[1862],{"type":44,"value":1863},"\u002Fmshta\\.exe http:\\\u002F\\\u002F...\u002F",{"type":44,"value":1865}," not ",{"type":38,"tag":129,"props":1867,"children":1869},{"className":1868},[],[1870],{"type":44,"value":1871},"\u002Fhttp:\\\u002F\\\u002F...\u002F",{"type":38,"tag":88,"props":1873,"children":1874},{},[1875],{"type":44,"value":1876},"If you can't anchor, consider hex pattern with wildcards instead",{"type":38,"tag":47,"props":1878,"children":1879},{},[1880],{"type":38,"tag":60,"props":1881,"children":1882},{},[1883],{"type":44,"value":1884},"Loop discipline:",{"type":38,"tag":154,"props":1886,"children":1887},{},[1888,1899],{"type":38,"tag":88,"props":1889,"children":1890},{},[1891,1893],{"type":44,"value":1892},"Always bound loops with filesize: ",{"type":38,"tag":129,"props":1894,"children":1896},{"className":1895},[],[1897],{"type":44,"value":1898},"filesize \u003C 100KB and for all i in (1..#a) : ...",{"type":38,"tag":88,"props":1900,"children":1901},{},[1902,1904,1910],{"type":44,"value":1903},"Unbounded ",{"type":38,"tag":129,"props":1905,"children":1907},{"className":1906},[],[1908],{"type":44,"value":1909},"#a",{"type":44,"value":1911}," can be thousands in large files — exponential slowdown",{"type":38,"tag":47,"props":1913,"children":1914},{},[1915,1920,1921,1927,1929,1935,1937,1942,1944,1949],{"type":38,"tag":60,"props":1916,"children":1917},{},[1918],{"type":44,"value":1919},"YARA-X tips:",{"type":44,"value":256},{"type":38,"tag":129,"props":1922,"children":1924},{"className":1923},[],[1925],{"type":44,"value":1926},"$_unused",{"type":44,"value":1928}," to suppress warnings; ",{"type":38,"tag":129,"props":1930,"children":1932},{"className":1931},[],[1933],{"type":44,"value":1934},"private $s",{"type":44,"value":1936}," to hide from output; ",{"type":38,"tag":129,"props":1938,"children":1940},{"className":1939},[],[1941],{"type":44,"value":293},{"type":44,"value":1943}," + ",{"type":38,"tag":129,"props":1945,"children":1947},{"className":1946},[],[1948],{"type":44,"value":300},{"type":44,"value":1950}," before every commit.",{"type":38,"tag":641,"props":1952,"children":1954},{"id":1953},"when-to-use-modules-vs-byte-checks",[1955],{"type":44,"value":1956},"When to Use Modules vs. Byte Checks",{"type":38,"tag":661,"props":1958,"children":1961},{"className":1959,"code":1960,"language":44},[970],"Should I use a module or raw bytes?\n├─ Need imphash\u002Frich header\u002Fauthenticode?\n│  └─ Use PE module — too complex to replicate\n├─ Just checking magic bytes or simple offsets?\n│  └─ Use uint16\u002Fuint32 — faster, no module overhead\n├─ Checking section names\u002Fsizes?\n│  └─ PE module is cleaner, but add magic bytes filter FIRST\n├─ Checking Chrome extension permissions?\n│  └─ Use crx module — string parsing is fragile\n└─ Checking LNK target paths?\n   └─ Use lnk module — LNK format is complex\n",[1962],{"type":38,"tag":129,"props":1963,"children":1964},{"__ignoreMap":666},[1965],{"type":44,"value":1960},{"type":38,"tag":47,"props":1967,"children":1968},{},[1969,1973],{"type":38,"tag":60,"props":1970,"children":1971},{},[1972],{"type":44,"value":1696},{"type":44,"value":1974}," \"Avoid the magic module — use explicit hex checks instead\" — Neo23x0. Apply this principle: if you can do it with uint32(), don't load a module.",{"type":38,"tag":77,"props":1976,"children":1978},{"id":1977},"yara-x-new-features",[1979],{"type":44,"value":1980},"YARA-X New Features",{"type":38,"tag":47,"props":1982,"children":1983},{},[1984],{"type":44,"value":1985},"Key additions from recent releases:",{"type":38,"tag":154,"props":1987,"children":1988},{},[1989,2007,2025,2043,2061],{"type":38,"tag":88,"props":1990,"children":1991},{},[1992,1997,1999,2005],{"type":38,"tag":60,"props":1993,"children":1994},{},[1995],{"type":44,"value":1996},"Private patterns",{"type":44,"value":1998}," (v1.3.0+): ",{"type":38,"tag":129,"props":2000,"children":2002},{"className":2001},[],[2003],{"type":44,"value":2004},"private $helper = \"pattern\"",{"type":44,"value":2006}," — matches but hidden from output",{"type":38,"tag":88,"props":2008,"children":2009},{},[2010,2015,2017,2023],{"type":38,"tag":60,"props":2011,"children":2012},{},[2013],{"type":44,"value":2014},"Warning suppression",{"type":44,"value":2016}," (v1.4.0+): ",{"type":38,"tag":129,"props":2018,"children":2020},{"className":2019},[],[2021],{"type":44,"value":2022},"\u002F\u002F suppress: slow_pattern",{"type":44,"value":2024}," inline comments",{"type":38,"tag":88,"props":2026,"children":2027},{},[2028,2033,2035,2041],{"type":38,"tag":60,"props":2029,"children":2030},{},[2031],{"type":44,"value":2032},"Numeric underscores",{"type":44,"value":2034}," (v1.5.0+): ",{"type":38,"tag":129,"props":2036,"children":2038},{"className":2037},[],[2039],{"type":44,"value":2040},"filesize \u003C 10_000_000",{"type":44,"value":2042}," for readability",{"type":38,"tag":88,"props":2044,"children":2045},{},[2046,2051,2053,2059],{"type":38,"tag":60,"props":2047,"children":2048},{},[2049],{"type":44,"value":2050},"Built-in formatter",{"type":44,"value":2052},": ",{"type":38,"tag":129,"props":2054,"children":2056},{"className":2055},[],[2057],{"type":44,"value":2058},"yr fmt rules\u002F",{"type":44,"value":2060}," to standardize formatting",{"type":38,"tag":88,"props":2062,"children":2063},{},[2064,2069,2070,2076],{"type":38,"tag":60,"props":2065,"children":2066},{},[2067],{"type":44,"value":2068},"NDJSON output",{"type":44,"value":2052},{"type":38,"tag":129,"props":2071,"children":2073},{"className":2072},[],[2074],{"type":44,"value":2075},"yr scan --output-format ndjson",{"type":44,"value":2077}," for tooling",{"type":38,"tag":77,"props":2079,"children":2081},{"id":2080},"yara-x-tooling-workflow",[2082],{"type":44,"value":2083},"YARA-X Tooling Workflow",{"type":38,"tag":47,"props":2085,"children":2086},{},[2087],{"type":44,"value":2088},"YARA-X provides diagnostic tools legacy YARA lacks:",{"type":38,"tag":47,"props":2090,"children":2091},{},[2092],{"type":38,"tag":60,"props":2093,"children":2094},{},[2095],{"type":44,"value":2096},"Rule development cycle:",{"type":38,"tag":661,"props":2098,"children":2102},{"className":2099,"code":2100,"language":2101,"meta":666,"style":666},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# 1. Write initial rule\n# 2. Check syntax with detailed errors\nyr check rule.yar\n\n# 3. Format consistently\nyr fmt -w rule.yar\n\n# 4. Dump module output to inspect file structure (no dummy rule needed)\nyr dump -m pe sample.exe --output-format yaml\n\n# 5. Scan with timing info\ntime yr scan -s rule.yar corpus\u002F\n","bash",[2103],{"type":38,"tag":129,"props":2104,"children":2105},{"__ignoreMap":666},[2106,2115,2123,2143,2150,2158,2179,2186,2194,2231,2238,2246],{"type":38,"tag":672,"props":2107,"children":2108},{"class":674,"line":675},[2109],{"type":38,"tag":672,"props":2110,"children":2112},{"style":2111},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[2113],{"type":44,"value":2114},"# 1. Write initial rule\n",{"type":38,"tag":672,"props":2116,"children":2117},{"class":674,"line":684},[2118],{"type":38,"tag":672,"props":2119,"children":2120},{"style":2111},[2121],{"type":44,"value":2122},"# 2. Check syntax with detailed errors\n",{"type":38,"tag":672,"props":2124,"children":2125},{"class":674,"line":693},[2126,2132,2138],{"type":38,"tag":672,"props":2127,"children":2129},{"style":2128},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[2130],{"type":44,"value":2131},"yr",{"type":38,"tag":672,"props":2133,"children":2135},{"style":2134},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[2136],{"type":44,"value":2137}," check",{"type":38,"tag":672,"props":2139,"children":2140},{"style":2134},[2141],{"type":44,"value":2142}," rule.yar\n",{"type":38,"tag":672,"props":2144,"children":2145},{"class":674,"line":702},[2146],{"type":38,"tag":672,"props":2147,"children":2148},{"emptyLinePlaceholder":886},[2149],{"type":44,"value":889},{"type":38,"tag":672,"props":2151,"children":2152},{"class":674,"line":711},[2153],{"type":38,"tag":672,"props":2154,"children":2155},{"style":2111},[2156],{"type":44,"value":2157},"# 3. Format consistently\n",{"type":38,"tag":672,"props":2159,"children":2160},{"class":674,"line":720},[2161,2165,2170,2175],{"type":38,"tag":672,"props":2162,"children":2163},{"style":2128},[2164],{"type":44,"value":2131},{"type":38,"tag":672,"props":2166,"children":2167},{"style":2134},[2168],{"type":44,"value":2169}," fmt",{"type":38,"tag":672,"props":2171,"children":2172},{"style":2134},[2173],{"type":44,"value":2174}," -w",{"type":38,"tag":672,"props":2176,"children":2177},{"style":2134},[2178],{"type":44,"value":2142},{"type":38,"tag":672,"props":2180,"children":2181},{"class":674,"line":882},[2182],{"type":38,"tag":672,"props":2183,"children":2184},{"emptyLinePlaceholder":886},[2185],{"type":44,"value":889},{"type":38,"tag":672,"props":2187,"children":2188},{"class":674,"line":892},[2189],{"type":38,"tag":672,"props":2190,"children":2191},{"style":2111},[2192],{"type":44,"value":2193},"# 4. Dump module output to inspect file structure (no dummy rule needed)\n",{"type":38,"tag":672,"props":2195,"children":2196},{"class":674,"line":901},[2197,2201,2206,2211,2216,2221,2226],{"type":38,"tag":672,"props":2198,"children":2199},{"style":2128},[2200],{"type":44,"value":2131},{"type":38,"tag":672,"props":2202,"children":2203},{"style":2134},[2204],{"type":44,"value":2205}," dump",{"type":38,"tag":672,"props":2207,"children":2208},{"style":2134},[2209],{"type":44,"value":2210}," -m",{"type":38,"tag":672,"props":2212,"children":2213},{"style":2134},[2214],{"type":44,"value":2215}," pe",{"type":38,"tag":672,"props":2217,"children":2218},{"style":2134},[2219],{"type":44,"value":2220}," sample.exe",{"type":38,"tag":672,"props":2222,"children":2223},{"style":2134},[2224],{"type":44,"value":2225}," --output-format",{"type":38,"tag":672,"props":2227,"children":2228},{"style":2134},[2229],{"type":44,"value":2230}," yaml\n",{"type":38,"tag":672,"props":2232,"children":2233},{"class":674,"line":910},[2234],{"type":38,"tag":672,"props":2235,"children":2236},{"emptyLinePlaceholder":886},[2237],{"type":44,"value":889},{"type":38,"tag":672,"props":2239,"children":2240},{"class":674,"line":919},[2241],{"type":38,"tag":672,"props":2242,"children":2243},{"style":2111},[2244],{"type":44,"value":2245},"# 5. Scan with timing info\n",{"type":38,"tag":672,"props":2247,"children":2248},{"class":674,"line":927},[2249,2255],{"type":38,"tag":672,"props":2250,"children":2252},{"style":2251},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[2253],{"type":44,"value":2254},"time",{"type":38,"tag":672,"props":2256,"children":2258},{"style":2257},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[2259],{"type":44,"value":2260}," yr scan -s rule.yar corpus\u002F\n",{"type":38,"tag":47,"props":2262,"children":2263},{},[2264],{"type":38,"tag":60,"props":2265,"children":2266},{},[2267,2269,2274],{"type":44,"value":2268},"When to use ",{"type":38,"tag":129,"props":2270,"children":2272},{"className":2271},[],[2273],{"type":44,"value":307},{"type":44,"value":2275},":",{"type":38,"tag":154,"props":2277,"children":2278},{},[2279,2284,2289],{"type":38,"tag":88,"props":2280,"children":2281},{},[2282],{"type":44,"value":2283},"Investigating what PE\u002FELF\u002FMach-O fields are available",{"type":38,"tag":88,"props":2285,"children":2286},{},[2287],{"type":44,"value":2288},"Debugging why module conditions aren't matching",{"type":38,"tag":88,"props":2290,"children":2291},{},[2292],{"type":44,"value":2293},"Exploring new modules (crx, lnk, dotnet) before writing rules",{"type":38,"tag":47,"props":2295,"children":2296},{},[2297,2302,2304,2309],{"type":38,"tag":60,"props":2298,"children":2299},{},[2300],{"type":44,"value":2301},"YARA-X diagnostic advantage:",{"type":44,"value":2303}," Error messages include precise source locations. If ",{"type":38,"tag":129,"props":2305,"children":2307},{"className":2306},[],[2308],{"type":44,"value":293},{"type":44,"value":2310}," points to line 15, the issue is actually on line 15 (unlike legacy YARA).",{"type":38,"tag":77,"props":2312,"children":2314},{"id":2313},"chrome-extension-analysis-crx-module",[2315],{"type":44,"value":2316},"Chrome Extension Analysis (crx module)",{"type":38,"tag":47,"props":2318,"children":2319},{},[2320,2322,2327,2329,2335],{"type":44,"value":2321},"The ",{"type":38,"tag":129,"props":2323,"children":2325},{"className":2324},[],[2326],{"type":44,"value":595},{"type":44,"value":2328}," module enables detection of malicious Chrome extensions. Requires YARA-X v1.5.0+ (basic), v1.11.0+ for ",{"type":38,"tag":129,"props":2330,"children":2332},{"className":2331},[],[2333],{"type":44,"value":2334},"permhash()",{"type":44,"value":1501},{"type":38,"tag":47,"props":2337,"children":2338},{},[2339,2344,2345,2351,2352,2358,2359],{"type":38,"tag":60,"props":2340,"children":2341},{},[2342],{"type":44,"value":2343},"Key APIs:",{"type":44,"value":256},{"type":38,"tag":129,"props":2346,"children":2348},{"className":2347},[],[2349],{"type":44,"value":2350},"crx.is_crx",{"type":44,"value":287},{"type":38,"tag":129,"props":2353,"children":2355},{"className":2354},[],[2356],{"type":44,"value":2357},"crx.permissions",{"type":44,"value":287},{"type":38,"tag":129,"props":2360,"children":2362},{"className":2361},[],[2363],{"type":44,"value":2364},"crx.permhash()",{"type":38,"tag":47,"props":2366,"children":2367},{},[2368,2373,2374,2380,2381,2387,2388,2394,2396],{"type":38,"tag":60,"props":2369,"children":2370},{},[2371],{"type":44,"value":2372},"Red flags:",{"type":44,"value":256},{"type":38,"tag":129,"props":2375,"children":2377},{"className":2376},[],[2378],{"type":44,"value":2379},"nativeMessaging",{"type":44,"value":1943},{"type":38,"tag":129,"props":2382,"children":2384},{"className":2383},[],[2385],{"type":44,"value":2386},"downloads",{"type":44,"value":287},{"type":38,"tag":129,"props":2389,"children":2391},{"className":2390},[],[2392],{"type":44,"value":2393},"debugger",{"type":44,"value":2395}," permission, content scripts on ",{"type":38,"tag":129,"props":2397,"children":2399},{"className":2398},[],[2400],{"type":44,"value":2401},"\u003Call_urls>",{"type":38,"tag":661,"props":2403,"children":2405},{"className":663,"code":2404,"language":665,"meta":666,"style":666},"import \"crx\"\n\nrule SUSP_CRX_HighRiskPerms {\n    condition:\n        crx.is_crx and\n        for any perm in crx.permissions : (perm == \"debugger\")\n}\n",[2406],{"type":38,"tag":129,"props":2407,"children":2408},{"__ignoreMap":666},[2409,2417,2424,2432,2439,2447,2455],{"type":38,"tag":672,"props":2410,"children":2411},{"class":674,"line":675},[2412],{"type":38,"tag":672,"props":2413,"children":2414},{},[2415],{"type":44,"value":2416},"import \"crx\"\n",{"type":38,"tag":672,"props":2418,"children":2419},{"class":674,"line":684},[2420],{"type":38,"tag":672,"props":2421,"children":2422},{"emptyLinePlaceholder":886},[2423],{"type":44,"value":889},{"type":38,"tag":672,"props":2425,"children":2426},{"class":674,"line":693},[2427],{"type":38,"tag":672,"props":2428,"children":2429},{},[2430],{"type":44,"value":2431},"rule SUSP_CRX_HighRiskPerms {\n",{"type":38,"tag":672,"props":2433,"children":2434},{"class":674,"line":702},[2435],{"type":38,"tag":672,"props":2436,"children":2437},{},[2438],{"type":44,"value":933},{"type":38,"tag":672,"props":2440,"children":2441},{"class":674,"line":711},[2442],{"type":38,"tag":672,"props":2443,"children":2444},{},[2445],{"type":44,"value":2446},"        crx.is_crx and\n",{"type":38,"tag":672,"props":2448,"children":2449},{"class":674,"line":720},[2450],{"type":38,"tag":672,"props":2451,"children":2452},{},[2453],{"type":44,"value":2454},"        for any perm in crx.permissions : (perm == \"debugger\")\n",{"type":38,"tag":672,"props":2456,"children":2457},{"class":674,"line":882},[2458],{"type":38,"tag":672,"props":2459,"children":2460},{},[2461],{"type":44,"value":960},{"type":38,"tag":47,"props":2463,"children":2464},{},[2465,2467,2473],{"type":44,"value":2466},"See ",{"type":38,"tag":68,"props":2468,"children":2470},{"href":2469},"references\u002Fcrx-module.md",[2471],{"type":44,"value":2472},"crx-module.md",{"type":44,"value":2474}," for complete API reference, permission risk assessment, and example rules.",{"type":38,"tag":77,"props":2476,"children":2478},{"id":2477},"android-dex-analysis-dex-module",[2479],{"type":44,"value":2480},"Android DEX Analysis (dex module)",{"type":38,"tag":47,"props":2482,"children":2483},{},[2484,2485,2490,2492,2497],{"type":44,"value":2321},{"type":38,"tag":129,"props":2486,"children":2488},{"className":2487},[],[2489],{"type":44,"value":628},{"type":44,"value":2491}," module enables detection of Android malware. Requires YARA-X v1.11.0+. ",{"type":38,"tag":60,"props":2493,"children":2494},{},[2495],{"type":44,"value":2496},"Not compatible with legacy YARA's dex module",{"type":44,"value":2498}," — API is completely different.",{"type":38,"tag":47,"props":2500,"children":2501},{},[2502,2506,2507,2513,2514,2520,2521,2527,2528],{"type":38,"tag":60,"props":2503,"children":2504},{},[2505],{"type":44,"value":2343},{"type":44,"value":256},{"type":38,"tag":129,"props":2508,"children":2510},{"className":2509},[],[2511],{"type":44,"value":2512},"dex.is_dex",{"type":44,"value":287},{"type":38,"tag":129,"props":2515,"children":2517},{"className":2516},[],[2518],{"type":44,"value":2519},"dex.contains_class()",{"type":44,"value":287},{"type":38,"tag":129,"props":2522,"children":2524},{"className":2523},[],[2525],{"type":44,"value":2526},"dex.contains_method()",{"type":44,"value":287},{"type":38,"tag":129,"props":2529,"children":2531},{"className":2530},[],[2532],{"type":44,"value":2533},"dex.contains_string()",{"type":38,"tag":47,"props":2535,"children":2536},{},[2537,2541,2543,2549],{"type":38,"tag":60,"props":2538,"children":2539},{},[2540],{"type":44,"value":2372},{"type":44,"value":2542}," Single-letter class names (obfuscation), ",{"type":38,"tag":129,"props":2544,"children":2546},{"className":2545},[],[2547],{"type":44,"value":2548},"DexClassLoader",{"type":44,"value":2550}," reflection, encrypted assets",{"type":38,"tag":661,"props":2552,"children":2554},{"className":663,"code":2553,"language":665,"meta":666,"style":666},"import \"dex\"\n\nrule SUSP_DEX_DynamicLoading {\n    condition:\n        dex.is_dex and\n        dex.contains_class(\"Ldalvik\u002Fsystem\u002FDexClassLoader;\")\n}\n",[2555],{"type":38,"tag":129,"props":2556,"children":2557},{"__ignoreMap":666},[2558,2566,2573,2581,2588,2596,2604],{"type":38,"tag":672,"props":2559,"children":2560},{"class":674,"line":675},[2561],{"type":38,"tag":672,"props":2562,"children":2563},{},[2564],{"type":44,"value":2565},"import \"dex\"\n",{"type":38,"tag":672,"props":2567,"children":2568},{"class":674,"line":684},[2569],{"type":38,"tag":672,"props":2570,"children":2571},{"emptyLinePlaceholder":886},[2572],{"type":44,"value":889},{"type":38,"tag":672,"props":2574,"children":2575},{"class":674,"line":693},[2576],{"type":38,"tag":672,"props":2577,"children":2578},{},[2579],{"type":44,"value":2580},"rule SUSP_DEX_DynamicLoading {\n",{"type":38,"tag":672,"props":2582,"children":2583},{"class":674,"line":702},[2584],{"type":38,"tag":672,"props":2585,"children":2586},{},[2587],{"type":44,"value":933},{"type":38,"tag":672,"props":2589,"children":2590},{"class":674,"line":711},[2591],{"type":38,"tag":672,"props":2592,"children":2593},{},[2594],{"type":44,"value":2595},"        dex.is_dex and\n",{"type":38,"tag":672,"props":2597,"children":2598},{"class":674,"line":720},[2599],{"type":38,"tag":672,"props":2600,"children":2601},{},[2602],{"type":44,"value":2603},"        dex.contains_class(\"Ldalvik\u002Fsystem\u002FDexClassLoader;\")\n",{"type":38,"tag":672,"props":2605,"children":2606},{"class":674,"line":882},[2607],{"type":38,"tag":672,"props":2608,"children":2609},{},[2610],{"type":44,"value":960},{"type":38,"tag":47,"props":2612,"children":2613},{},[2614,2615,2621],{"type":44,"value":2466},{"type":38,"tag":68,"props":2616,"children":2618},{"href":2617},"references\u002Fdex-module.md",[2619],{"type":44,"value":2620},"dex-module.md",{"type":44,"value":2622}," for complete API reference, obfuscation detection, and example rules.",{"type":38,"tag":77,"props":2624,"children":2626},{"id":2625},"migrating-from-legacy-yara",[2627],{"type":44,"value":73},{"type":38,"tag":47,"props":2629,"children":2630},{},[2631],{"type":44,"value":2632},"YARA-X has 99% rule compatibility, but enforces stricter validation.",{"type":38,"tag":47,"props":2634,"children":2635},{},[2636],{"type":38,"tag":60,"props":2637,"children":2638},{},[2639],{"type":44,"value":2640},"Quick migration:",{"type":38,"tag":661,"props":2642,"children":2644},{"className":2099,"code":2643,"language":2101,"meta":666,"style":666},"yr check --relaxed-re-syntax rules\u002F  # Identify issues\n# Fix each issue, then:\nyr check rules\u002F  # Verify without relaxed mode\n",[2645],{"type":38,"tag":129,"props":2646,"children":2647},{"__ignoreMap":666},[2648,2674,2682],{"type":38,"tag":672,"props":2649,"children":2650},{"class":674,"line":675},[2651,2655,2659,2664,2669],{"type":38,"tag":672,"props":2652,"children":2653},{"style":2128},[2654],{"type":44,"value":2131},{"type":38,"tag":672,"props":2656,"children":2657},{"style":2134},[2658],{"type":44,"value":2137},{"type":38,"tag":672,"props":2660,"children":2661},{"style":2134},[2662],{"type":44,"value":2663}," --relaxed-re-syntax",{"type":38,"tag":672,"props":2665,"children":2666},{"style":2134},[2667],{"type":44,"value":2668}," rules\u002F",{"type":38,"tag":672,"props":2670,"children":2671},{"style":2111},[2672],{"type":44,"value":2673},"  # Identify issues\n",{"type":38,"tag":672,"props":2675,"children":2676},{"class":674,"line":684},[2677],{"type":38,"tag":672,"props":2678,"children":2679},{"style":2111},[2680],{"type":44,"value":2681},"# Fix each issue, then:\n",{"type":38,"tag":672,"props":2683,"children":2684},{"class":674,"line":693},[2685,2689,2693,2697],{"type":38,"tag":672,"props":2686,"children":2687},{"style":2128},[2688],{"type":44,"value":2131},{"type":38,"tag":672,"props":2690,"children":2691},{"style":2134},[2692],{"type":44,"value":2137},{"type":38,"tag":672,"props":2694,"children":2695},{"style":2134},[2696],{"type":44,"value":2668},{"type":38,"tag":672,"props":2698,"children":2699},{"style":2111},[2700],{"type":44,"value":2701},"  # Verify without relaxed mode\n",{"type":38,"tag":47,"props":2703,"children":2704},{},[2705],{"type":38,"tag":60,"props":2706,"children":2707},{},[2708],{"type":44,"value":2709},"Common fixes:",{"type":38,"tag":320,"props":2711,"children":2712},{},[2713,2734],{"type":38,"tag":324,"props":2714,"children":2715},{},[2716],{"type":38,"tag":328,"props":2717,"children":2718},{},[2719,2724,2729],{"type":38,"tag":332,"props":2720,"children":2721},{},[2722],{"type":44,"value":2723},"Issue",{"type":38,"tag":332,"props":2725,"children":2726},{},[2727],{"type":44,"value":2728},"Legacy",{"type":38,"tag":332,"props":2730,"children":2731},{},[2732],{"type":44,"value":2733},"YARA-X Fix",{"type":38,"tag":353,"props":2735,"children":2736},{},[2737,2771,2806,2824,2850],{"type":38,"tag":328,"props":2738,"children":2739},{},[2740,2753,2762],{"type":38,"tag":360,"props":2741,"children":2742},{},[2743,2745,2751],{"type":44,"value":2744},"Literal ",{"type":38,"tag":129,"props":2746,"children":2748},{"className":2747},[],[2749],{"type":44,"value":2750},"{",{"type":44,"value":2752}," in regex",{"type":38,"tag":360,"props":2754,"children":2755},{},[2756],{"type":38,"tag":129,"props":2757,"children":2759},{"className":2758},[],[2760],{"type":44,"value":2761},"\u002F{\u002F",{"type":38,"tag":360,"props":2763,"children":2764},{},[2765],{"type":38,"tag":129,"props":2766,"children":2768},{"className":2767},[],[2769],{"type":44,"value":2770},"\u002F\\{\u002F",{"type":38,"tag":328,"props":2772,"children":2773},{},[2774,2779,2790],{"type":38,"tag":360,"props":2775,"children":2776},{},[2777],{"type":44,"value":2778},"Invalid escapes",{"type":38,"tag":360,"props":2780,"children":2781},{},[2782,2788],{"type":38,"tag":129,"props":2783,"children":2785},{"className":2784},[],[2786],{"type":44,"value":2787},"\\R",{"type":44,"value":2789}," silently literal",{"type":38,"tag":360,"props":2791,"children":2792},{},[2793,2799,2800],{"type":38,"tag":129,"props":2794,"children":2796},{"className":2795},[],[2797],{"type":44,"value":2798},"\\\\R",{"type":44,"value":1797},{"type":38,"tag":129,"props":2801,"children":2803},{"className":2802},[],[2804],{"type":44,"value":2805},"R",{"type":38,"tag":328,"props":2807,"children":2808},{},[2809,2814,2819],{"type":38,"tag":360,"props":2810,"children":2811},{},[2812],{"type":44,"value":2813},"Base64 strings",{"type":38,"tag":360,"props":2815,"children":2816},{},[2817],{"type":44,"value":2818},"Any length",{"type":38,"tag":360,"props":2820,"children":2821},{},[2822],{"type":44,"value":2823},"3+ chars required",{"type":38,"tag":328,"props":2825,"children":2826},{},[2827,2832,2841],{"type":38,"tag":360,"props":2828,"children":2829},{},[2830],{"type":44,"value":2831},"Negative indexing",{"type":38,"tag":360,"props":2833,"children":2834},{},[2835],{"type":38,"tag":129,"props":2836,"children":2838},{"className":2837},[],[2839],{"type":44,"value":2840},"@a[-1]",{"type":38,"tag":360,"props":2842,"children":2843},{},[2844],{"type":38,"tag":129,"props":2845,"children":2847},{"className":2846},[],[2848],{"type":44,"value":2849},"@a[#a - 1]",{"type":38,"tag":328,"props":2851,"children":2852},{},[2853,2858,2863],{"type":38,"tag":360,"props":2854,"children":2855},{},[2856],{"type":44,"value":2857},"Duplicate modifiers",{"type":38,"tag":360,"props":2859,"children":2860},{},[2861],{"type":44,"value":2862},"Allowed",{"type":38,"tag":360,"props":2864,"children":2865},{},[2866],{"type":44,"value":2867},"Remove duplicates",{"type":38,"tag":53,"props":2869,"children":2870},{},[2871],{"type":38,"tag":47,"props":2872,"children":2873},{},[2874,2879,2881,2887],{"type":38,"tag":60,"props":2875,"children":2876},{},[2877],{"type":44,"value":2878},"Note:",{"type":44,"value":2880}," Use ",{"type":38,"tag":129,"props":2882,"children":2884},{"className":2883},[],[2885],{"type":44,"value":2886},"--relaxed-re-syntax",{"type":44,"value":2888}," only as a diagnostic tool. Fix issues rather than relying on relaxed mode.",{"type":38,"tag":77,"props":2890,"children":2892},{"id":2891},"quick-reference",[2893],{"type":44,"value":2894},"Quick Reference",{"type":38,"tag":641,"props":2896,"children":2898},{"id":2897},"naming-convention",[2899],{"type":44,"value":2900},"Naming Convention",{"type":38,"tag":661,"props":2902,"children":2905},{"className":2903,"code":2904,"language":44},[970],"{CATEGORY}_{PLATFORM}_{FAMILY}_{VARIANT}_{DATE}\n",[2906],{"type":38,"tag":129,"props":2907,"children":2908},{"__ignoreMap":666},[2909],{"type":44,"value":2904},{"type":38,"tag":47,"props":2911,"children":2912},{},[2913,2918,2919,2925,2927,2933,2935,2941,2942,2948,2949,2955,2957,2963],{"type":38,"tag":60,"props":2914,"children":2915},{},[2916],{"type":44,"value":2917},"Common prefixes:",{"type":44,"value":256},{"type":38,"tag":129,"props":2920,"children":2922},{"className":2921},[],[2923],{"type":44,"value":2924},"MAL_",{"type":44,"value":2926}," (malware), ",{"type":38,"tag":129,"props":2928,"children":2930},{"className":2929},[],[2931],{"type":44,"value":2932},"HKTL_",{"type":44,"value":2934}," (hacking tool), ",{"type":38,"tag":129,"props":2936,"children":2938},{"className":2937},[],[2939],{"type":44,"value":2940},"WEBSHELL_",{"type":44,"value":287},{"type":38,"tag":129,"props":2943,"children":2945},{"className":2944},[],[2946],{"type":44,"value":2947},"EXPL_",{"type":44,"value":287},{"type":38,"tag":129,"props":2950,"children":2952},{"className":2951},[],[2953],{"type":44,"value":2954},"SUSP_",{"type":44,"value":2956}," (suspicious), ",{"type":38,"tag":129,"props":2958,"children":2960},{"className":2959},[],[2961],{"type":44,"value":2962},"GEN_",{"type":44,"value":2964}," (generic)",{"type":38,"tag":47,"props":2966,"children":2967},{},[2968,2973,2974,2980,2981,2987,2988,2994,2995,3001,3002],{"type":38,"tag":60,"props":2969,"children":2970},{},[2971],{"type":44,"value":2972},"Platforms:",{"type":44,"value":256},{"type":38,"tag":129,"props":2975,"children":2977},{"className":2976},[],[2978],{"type":44,"value":2979},"Win_",{"type":44,"value":287},{"type":38,"tag":129,"props":2982,"children":2984},{"className":2983},[],[2985],{"type":44,"value":2986},"Lnx_",{"type":44,"value":287},{"type":38,"tag":129,"props":2989,"children":2991},{"className":2990},[],[2992],{"type":44,"value":2993},"Mac_",{"type":44,"value":287},{"type":38,"tag":129,"props":2996,"children":2998},{"className":2997},[],[2999],{"type":44,"value":3000},"Android_",{"type":44,"value":287},{"type":38,"tag":129,"props":3003,"children":3005},{"className":3004},[],[3006],{"type":44,"value":3007},"CRX_",{"type":38,"tag":47,"props":3009,"children":3010},{},[3011,3016,3017],{"type":38,"tag":60,"props":3012,"children":3013},{},[3014],{"type":44,"value":3015},"Example:",{"type":44,"value":256},{"type":38,"tag":129,"props":3018,"children":3020},{"className":3019},[],[3021],{"type":44,"value":3022},"MAL_Win_Emotet_Loader_Jan25",{"type":38,"tag":47,"props":3024,"children":3025},{},[3026,3027,3033],{"type":44,"value":2466},{"type":38,"tag":68,"props":3028,"children":3030},{"href":3029},"references\u002Fstyle-guide.md",[3031],{"type":44,"value":3032},"style-guide.md",{"type":44,"value":3034}," for full conventions, metadata requirements, and naming examples.",{"type":38,"tag":641,"props":3036,"children":3038},{"id":3037},"required-metadata",[3039],{"type":44,"value":3040},"Required Metadata",{"type":38,"tag":47,"props":3042,"children":3043},{},[3044,3046,3052,3054,3060,3061,3067,3068,3074],{"type":44,"value":3045},"Every rule needs: ",{"type":38,"tag":129,"props":3047,"children":3049},{"className":3048},[],[3050],{"type":44,"value":3051},"description",{"type":44,"value":3053}," (starts with \"Detects\"), ",{"type":38,"tag":129,"props":3055,"children":3057},{"className":3056},[],[3058],{"type":44,"value":3059},"author",{"type":44,"value":287},{"type":38,"tag":129,"props":3062,"children":3064},{"className":3063},[],[3065],{"type":44,"value":3066},"reference",{"type":44,"value":287},{"type":38,"tag":129,"props":3069,"children":3071},{"className":3070},[],[3072],{"type":44,"value":3073},"date",{"type":44,"value":1501},{"type":38,"tag":661,"props":3076,"children":3078},{"className":663,"code":3077,"language":665,"meta":666,"style":666},"meta:\n    description = \"Detects Example malware via unique mutex and C2 path\"\n    author = \"Your Name \u003Cemail@example.com>\"\n    reference = \"https:\u002F\u002Fexample.com\u002Fanalysis\"\n    date = \"2025-01-29\"\n",[3079],{"type":38,"tag":129,"props":3080,"children":3081},{"__ignoreMap":666},[3082,3090,3098,3106,3114],{"type":38,"tag":672,"props":3083,"children":3084},{"class":674,"line":675},[3085],{"type":38,"tag":672,"props":3086,"children":3087},{},[3088],{"type":44,"value":3089},"meta:\n",{"type":38,"tag":672,"props":3091,"children":3092},{"class":674,"line":684},[3093],{"type":38,"tag":672,"props":3094,"children":3095},{},[3096],{"type":44,"value":3097},"    description = \"Detects Example malware via unique mutex and C2 path\"\n",{"type":38,"tag":672,"props":3099,"children":3100},{"class":674,"line":693},[3101],{"type":38,"tag":672,"props":3102,"children":3103},{},[3104],{"type":44,"value":3105},"    author = \"Your Name \u003Cemail@example.com>\"\n",{"type":38,"tag":672,"props":3107,"children":3108},{"class":674,"line":702},[3109],{"type":38,"tag":672,"props":3110,"children":3111},{},[3112],{"type":44,"value":3113},"    reference = \"https:\u002F\u002Fexample.com\u002Fanalysis\"\n",{"type":38,"tag":672,"props":3115,"children":3116},{"class":674,"line":711},[3117],{"type":38,"tag":672,"props":3118,"children":3119},{},[3120],{"type":44,"value":3121},"    date = \"2025-01-29\"\n",{"type":38,"tag":641,"props":3123,"children":3125},{"id":3124},"string-selection",[3126],{"type":44,"value":3127},"String Selection",{"type":38,"tag":47,"props":3129,"children":3130},{},[3131,3136,3138,3143],{"type":38,"tag":60,"props":3132,"children":3133},{},[3134],{"type":44,"value":3135},"Good:",{"type":44,"value":3137}," Mutex names, PDB paths, C2 paths, stack strings, configuration markers\n",{"type":38,"tag":60,"props":3139,"children":3140},{},[3141],{"type":44,"value":3142},"Bad:",{"type":44,"value":3144}," API names, common executables, format specifiers, generic paths",{"type":38,"tag":47,"props":3146,"children":3147},{},[3148,3149,3155],{"type":44,"value":2466},{"type":38,"tag":68,"props":3150,"children":3152},{"href":3151},"references\u002Fstrings.md",[3153],{"type":44,"value":3154},"strings.md",{"type":44,"value":3156}," for the full decision tree and examples.",{"type":38,"tag":641,"props":3158,"children":3160},{"id":3159},"condition-patterns",[3161],{"type":44,"value":3162},"Condition Patterns",{"type":38,"tag":47,"props":3164,"children":3165},{},[3166],{"type":38,"tag":60,"props":3167,"children":3168},{},[3169],{"type":44,"value":3170},"Order conditions for short-circuit:",{"type":38,"tag":84,"props":3172,"children":3173},{},[3174,3185,3195,3200],{"type":38,"tag":88,"props":3175,"children":3176},{},[3177,3183],{"type":38,"tag":129,"props":3178,"children":3180},{"className":3179},[],[3181],{"type":44,"value":3182},"filesize \u003C 10MB",{"type":44,"value":3184}," (instant)",{"type":38,"tag":88,"props":3186,"children":3187},{},[3188,3193],{"type":38,"tag":129,"props":3189,"children":3191},{"className":3190},[],[3192],{"type":44,"value":376},{"type":44,"value":3194}," (nearly instant)",{"type":38,"tag":88,"props":3196,"children":3197},{},[3198],{"type":44,"value":3199},"String matches (cheap)",{"type":38,"tag":88,"props":3201,"children":3202},{},[3203],{"type":44,"value":3204},"Module checks (expensive)",{"type":38,"tag":47,"props":3206,"children":3207},{},[3208,3209,3215],{"type":44,"value":2466},{"type":38,"tag":68,"props":3210,"children":3212},{"href":3211},"references\u002Fperformance.md",[3213],{"type":44,"value":3214},"performance.md",{"type":44,"value":3216}," for detailed optimization patterns.",{"type":38,"tag":77,"props":3218,"children":3220},{"id":3219},"workflow",[3221],{"type":44,"value":3222},"Workflow",{"type":38,"tag":84,"props":3224,"children":3225},{},[3226,3236,3252,3262,3272,3294,3304],{"type":38,"tag":88,"props":3227,"children":3228},{},[3229,3234],{"type":38,"tag":60,"props":3230,"children":3231},{},[3232],{"type":44,"value":3233},"Gather samples",{"type":44,"value":3235}," — Multiple samples; single-sample rules are brittle",{"type":38,"tag":88,"props":3237,"children":3238},{},[3239,3244,3246],{"type":38,"tag":60,"props":3240,"children":3241},{},[3242],{"type":44,"value":3243},"Extract candidates",{"type":44,"value":3245}," — ",{"type":38,"tag":129,"props":3247,"children":3249},{"className":3248},[],[3250],{"type":44,"value":3251},"yarGen -m samples\u002F --excludegood",{"type":38,"tag":88,"props":3253,"children":3254},{},[3255,3260],{"type":38,"tag":60,"props":3256,"children":3257},{},[3258],{"type":44,"value":3259},"Validate quality",{"type":44,"value":3261}," — Use decision tree; yarGen needs 80% filtering",{"type":38,"tag":88,"props":3263,"children":3264},{},[3265,3270],{"type":38,"tag":60,"props":3266,"children":3267},{},[3268],{"type":44,"value":3269},"Write initial rule",{"type":44,"value":3271}," — Follow template with proper metadata",{"type":38,"tag":88,"props":3273,"children":3274},{},[3275,3280,3281,3286,3287,3292],{"type":38,"tag":60,"props":3276,"children":3277},{},[3278],{"type":44,"value":3279},"Lint and test",{"type":44,"value":3245},{"type":38,"tag":129,"props":3282,"children":3284},{"className":3283},[],[3285],{"type":44,"value":293},{"type":44,"value":287},{"type":38,"tag":129,"props":3288,"children":3290},{"className":3289},[],[3291],{"type":44,"value":300},{"type":44,"value":3293},", linter script",{"type":38,"tag":88,"props":3295,"children":3296},{},[3297,3302],{"type":38,"tag":60,"props":3298,"children":3299},{},[3300],{"type":44,"value":3301},"Goodware validation",{"type":44,"value":3303}," — VirusTotal corpus or local clean files",{"type":38,"tag":88,"props":3305,"children":3306},{},[3307,3312],{"type":38,"tag":60,"props":3308,"children":3309},{},[3310],{"type":44,"value":3311},"Deploy",{"type":44,"value":3313}," — Add to repo with full metadata, monitor for FPs",{"type":38,"tag":47,"props":3315,"children":3316},{},[3317,3318,3324],{"type":44,"value":2466},{"type":38,"tag":68,"props":3319,"children":3321},{"href":3320},"references\u002Ftesting.md",[3322],{"type":44,"value":3323},"testing.md",{"type":44,"value":3325}," for detailed validation workflow and FP investigation.",{"type":38,"tag":47,"props":3327,"children":3328},{},[3329,3331,3337],{"type":44,"value":3330},"For a comprehensive step-by-step guide covering all phases from sample collection to deployment, see ",{"type":38,"tag":68,"props":3332,"children":3334},{"href":3333},"workflows\u002Frule-development.md",[3335],{"type":44,"value":3336},"rule-development.md",{"type":44,"value":1501},{"type":38,"tag":77,"props":3339,"children":3341},{"id":3340},"common-mistakes",[3342],{"type":44,"value":3343},"Common Mistakes",{"type":38,"tag":320,"props":3345,"children":3346},{},[3347,3368],{"type":38,"tag":324,"props":3348,"children":3349},{},[3350],{"type":38,"tag":328,"props":3351,"children":3352},{},[3353,3358,3363],{"type":38,"tag":332,"props":3354,"children":3355},{},[3356],{"type":44,"value":3357},"Mistake",{"type":38,"tag":332,"props":3359,"children":3360},{},[3361],{"type":44,"value":3362},"Bad",{"type":38,"tag":332,"props":3364,"children":3365},{},[3366],{"type":44,"value":3367},"Good",{"type":38,"tag":353,"props":3369,"children":3370},{},[3371,3393,3419,3448,3478],{"type":38,"tag":328,"props":3372,"children":3373},{},[3374,3379,3388],{"type":38,"tag":360,"props":3375,"children":3376},{},[3377],{"type":44,"value":3378},"API names as indicators",{"type":38,"tag":360,"props":3380,"children":3381},{},[3382],{"type":38,"tag":129,"props":3383,"children":3385},{"className":3384},[],[3386],{"type":44,"value":3387},"\"VirtualAlloc\"",{"type":38,"tag":360,"props":3389,"children":3390},{},[3391],{"type":44,"value":3392},"Hex pattern of call site + unique mutex",{"type":38,"tag":328,"props":3394,"children":3395},{},[3396,3401,3410],{"type":38,"tag":360,"props":3397,"children":3398},{},[3399],{"type":44,"value":3400},"Unbounded regex",{"type":38,"tag":360,"props":3402,"children":3403},{},[3404],{"type":38,"tag":129,"props":3405,"children":3407},{"className":3406},[],[3408],{"type":44,"value":3409},"\u002Fhttps?:\\\u002F\\\u002F.*\u002F",{"type":38,"tag":360,"props":3411,"children":3412},{},[3413],{"type":38,"tag":129,"props":3414,"children":3416},{"className":3415},[],[3417],{"type":44,"value":3418},"\u002Fhttps?:\\\u002F\\\u002F[a-z0-9]{8,12}\\.onion\u002F",{"type":38,"tag":328,"props":3420,"children":3421},{},[3422,3427,3438],{"type":38,"tag":360,"props":3423,"children":3424},{},[3425],{"type":44,"value":3426},"Missing file type filter",{"type":38,"tag":360,"props":3428,"children":3429},{},[3430,3436],{"type":38,"tag":129,"props":3431,"children":3433},{"className":3432},[],[3434],{"type":44,"value":3435},"pe.imports(...)",{"type":44,"value":3437}," first",{"type":38,"tag":360,"props":3439,"children":3440},{},[3441,3447],{"type":38,"tag":129,"props":3442,"children":3444},{"className":3443},[],[3445],{"type":44,"value":3446},"uint16(0) == 0x5A4D and filesize \u003C 10MB",{"type":44,"value":3437},{"type":38,"tag":328,"props":3449,"children":3450},{},[3451,3456,3467],{"type":38,"tag":360,"props":3452,"children":3453},{},[3454],{"type":44,"value":3455},"Short strings",{"type":38,"tag":360,"props":3457,"children":3458},{},[3459,3465],{"type":38,"tag":129,"props":3460,"children":3462},{"className":3461},[],[3463],{"type":44,"value":3464},"\"abc\"",{"type":44,"value":3466}," (3 bytes)",{"type":38,"tag":360,"props":3468,"children":3469},{},[3470,3476],{"type":38,"tag":129,"props":3471,"children":3473},{"className":3472},[],[3474],{"type":44,"value":3475},"\"abcdef\"",{"type":44,"value":3477}," (4+ bytes)",{"type":38,"tag":328,"props":3479,"children":3480},{},[3481,3486,3495],{"type":38,"tag":360,"props":3482,"children":3483},{},[3484],{"type":44,"value":3485},"Unescaped braces (YARA-X)",{"type":38,"tag":360,"props":3487,"children":3488},{},[3489],{"type":38,"tag":129,"props":3490,"children":3492},{"className":3491},[],[3493],{"type":44,"value":3494},"\u002Fconfig{key}\u002F",{"type":38,"tag":360,"props":3496,"children":3497},{},[3498],{"type":38,"tag":129,"props":3499,"children":3501},{"className":3500},[],[3502],{"type":44,"value":3503},"\u002Fconfig\\{key\\}\u002F",{"type":38,"tag":77,"props":3505,"children":3507},{"id":3506},"performance-optimization",[3508],{"type":44,"value":3509},"Performance Optimization",{"type":38,"tag":47,"props":3511,"children":3512},{},[3513,3518,3520,3526,3528,3533,3535,3541],{"type":38,"tag":60,"props":3514,"children":3515},{},[3516],{"type":44,"value":3517},"Quick wins:",{"type":44,"value":3519}," Put ",{"type":38,"tag":129,"props":3521,"children":3523},{"className":3522},[],[3524],{"type":44,"value":3525},"filesize",{"type":44,"value":3527}," first, avoid ",{"type":38,"tag":129,"props":3529,"children":3531},{"className":3530},[],[3532],{"type":44,"value":1795},{"type":44,"value":3534},", bounded regex ",{"type":38,"tag":129,"props":3536,"children":3538},{"className":3537},[],[3539],{"type":44,"value":3540},"{1,100}",{"type":44,"value":3542},", prefer hex over regex.",{"type":38,"tag":47,"props":3544,"children":3545},{},[3546,3550,3552,3558],{"type":38,"tag":60,"props":3547,"children":3548},{},[3549],{"type":44,"value":2372},{"type":44,"value":3551}," Strings \u003C4 bytes, unbounded regex (",{"type":38,"tag":129,"props":3553,"children":3555},{"className":3554},[],[3556],{"type":44,"value":3557},".*",{"type":44,"value":3559},"), modules without file-type filter.",{"type":38,"tag":47,"props":3561,"children":3562},{},[3563,3564,3568],{"type":44,"value":2466},{"type":38,"tag":68,"props":3565,"children":3566},{"href":3211},[3567],{"type":44,"value":3214},{"type":44,"value":3569}," for atom theory and optimization details.",{"type":38,"tag":77,"props":3571,"children":3573},{"id":3572},"reference-documents",[3574],{"type":44,"value":3575},"Reference Documents",{"type":38,"tag":320,"props":3577,"children":3578},{},[3579,3595],{"type":38,"tag":324,"props":3580,"children":3581},{},[3582],{"type":38,"tag":328,"props":3583,"children":3584},{},[3585,3590],{"type":38,"tag":332,"props":3586,"children":3587},{},[3588],{"type":44,"value":3589},"Topic",{"type":38,"tag":332,"props":3591,"children":3592},{},[3593],{"type":44,"value":3594},"Document",{"type":38,"tag":353,"props":3596,"children":3597},{},[3598,3613,3628,3643,3658,3673],{"type":38,"tag":328,"props":3599,"children":3600},{},[3601,3606],{"type":38,"tag":360,"props":3602,"children":3603},{},[3604],{"type":44,"value":3605},"Naming and metadata conventions",{"type":38,"tag":360,"props":3607,"children":3608},{},[3609],{"type":38,"tag":68,"props":3610,"children":3611},{"href":3029},[3612],{"type":44,"value":3032},{"type":38,"tag":328,"props":3614,"children":3615},{},[3616,3621],{"type":38,"tag":360,"props":3617,"children":3618},{},[3619],{"type":44,"value":3620},"Performance and atom optimization",{"type":38,"tag":360,"props":3622,"children":3623},{},[3624],{"type":38,"tag":68,"props":3625,"children":3626},{"href":3211},[3627],{"type":44,"value":3214},{"type":38,"tag":328,"props":3629,"children":3630},{},[3631,3636],{"type":38,"tag":360,"props":3632,"children":3633},{},[3634],{"type":44,"value":3635},"String types and judgment",{"type":38,"tag":360,"props":3637,"children":3638},{},[3639],{"type":38,"tag":68,"props":3640,"children":3641},{"href":3151},[3642],{"type":44,"value":3154},{"type":38,"tag":328,"props":3644,"children":3645},{},[3646,3651],{"type":38,"tag":360,"props":3647,"children":3648},{},[3649],{"type":44,"value":3650},"Testing and validation",{"type":38,"tag":360,"props":3652,"children":3653},{},[3654],{"type":38,"tag":68,"props":3655,"children":3656},{"href":3320},[3657],{"type":44,"value":3323},{"type":38,"tag":328,"props":3659,"children":3660},{},[3661,3666],{"type":38,"tag":360,"props":3662,"children":3663},{},[3664],{"type":44,"value":3665},"Chrome extension module (crx)",{"type":38,"tag":360,"props":3667,"children":3668},{},[3669],{"type":38,"tag":68,"props":3670,"children":3671},{"href":2469},[3672],{"type":44,"value":2472},{"type":38,"tag":328,"props":3674,"children":3675},{},[3676,3681],{"type":38,"tag":360,"props":3677,"children":3678},{},[3679],{"type":44,"value":3680},"Android DEX module (dex)",{"type":38,"tag":360,"props":3682,"children":3683},{},[3684],{"type":38,"tag":68,"props":3685,"children":3686},{"href":2617},[3687],{"type":44,"value":2620},{"type":38,"tag":77,"props":3689,"children":3691},{"id":3690},"workflows",[3692],{"type":44,"value":3693},"Workflows",{"type":38,"tag":320,"props":3695,"children":3696},{},[3697,3711],{"type":38,"tag":324,"props":3698,"children":3699},{},[3700],{"type":38,"tag":328,"props":3701,"children":3702},{},[3703,3707],{"type":38,"tag":332,"props":3704,"children":3705},{},[3706],{"type":44,"value":3589},{"type":38,"tag":332,"props":3708,"children":3709},{},[3710],{"type":44,"value":3594},{"type":38,"tag":353,"props":3712,"children":3713},{},[3714],{"type":38,"tag":328,"props":3715,"children":3716},{},[3717,3722],{"type":38,"tag":360,"props":3718,"children":3719},{},[3720],{"type":44,"value":3721},"Complete rule development process",{"type":38,"tag":360,"props":3723,"children":3724},{},[3725],{"type":38,"tag":68,"props":3726,"children":3727},{"href":3333},[3728],{"type":44,"value":3336},{"type":38,"tag":77,"props":3730,"children":3732},{"id":3731},"example-rules",[3733],{"type":44,"value":3734},"Example Rules",{"type":38,"tag":47,"props":3736,"children":3737},{},[3738,3739,3745],{"type":44,"value":2321},{"type":38,"tag":129,"props":3740,"children":3742},{"className":3741},[],[3743],{"type":44,"value":3744},"examples\u002F",{"type":44,"value":3746}," directory contains real, attributed rules demonstrating best practices:",{"type":38,"tag":320,"props":3748,"children":3749},{},[3750,3771],{"type":38,"tag":324,"props":3751,"children":3752},{},[3753],{"type":38,"tag":328,"props":3754,"children":3755},{},[3756,3761,3766],{"type":38,"tag":332,"props":3757,"children":3758},{},[3759],{"type":44,"value":3760},"Example",{"type":38,"tag":332,"props":3762,"children":3763},{},[3764],{"type":44,"value":3765},"Demonstrates",{"type":38,"tag":332,"props":3767,"children":3768},{},[3769],{"type":44,"value":3770},"Source",{"type":38,"tag":353,"props":3772,"children":3773},{},[3774,3796,3818,3840,3862],{"type":38,"tag":328,"props":3775,"children":3776},{},[3777,3786,3791],{"type":38,"tag":360,"props":3778,"children":3779},{},[3780],{"type":38,"tag":68,"props":3781,"children":3783},{"href":3782},"examples\u002FMAL_Win_Remcos_Jan25.yar",[3784],{"type":44,"value":3785},"MAL_Win_Remcos_Jan25.yar",{"type":38,"tag":360,"props":3787,"children":3788},{},[3789],{"type":44,"value":3790},"PE malware: graduated string counts, multiple rules per family",{"type":38,"tag":360,"props":3792,"children":3793},{},[3794],{"type":44,"value":3795},"Elastic Security",{"type":38,"tag":328,"props":3797,"children":3798},{},[3799,3808,3813],{"type":38,"tag":360,"props":3800,"children":3801},{},[3802],{"type":38,"tag":68,"props":3803,"children":3805},{"href":3804},"examples\u002FMAL_Mac_ProtonRAT_Jan25.yar",[3806],{"type":44,"value":3807},"MAL_Mac_ProtonRAT_Jan25.yar",{"type":38,"tag":360,"props":3809,"children":3810},{},[3811],{"type":44,"value":3812},"macOS: Mach-O magic bytes, multi-category grouping",{"type":38,"tag":360,"props":3814,"children":3815},{},[3816],{"type":44,"value":3817},"Airbnb BinaryAlert",{"type":38,"tag":328,"props":3819,"children":3820},{},[3821,3830,3835],{"type":38,"tag":360,"props":3822,"children":3823},{},[3824],{"type":38,"tag":68,"props":3825,"children":3827},{"href":3826},"examples\u002FMAL_NPM_SupplyChain_Jan25.yar",[3828],{"type":44,"value":3829},"MAL_NPM_SupplyChain_Jan25.yar",{"type":38,"tag":360,"props":3831,"children":3832},{},[3833],{"type":44,"value":3834},"npm supply chain: real attack patterns, ERC-20 selectors",{"type":38,"tag":360,"props":3836,"children":3837},{},[3838],{"type":44,"value":3839},"Stairwell Research",{"type":38,"tag":328,"props":3841,"children":3842},{},[3843,3852,3857],{"type":38,"tag":360,"props":3844,"children":3845},{},[3846],{"type":38,"tag":68,"props":3847,"children":3849},{"href":3848},"examples\u002FSUSP_JS_Obfuscation_Jan25.yar",[3850],{"type":44,"value":3851},"SUSP_JS_Obfuscation_Jan25.yar",{"type":38,"tag":360,"props":3853,"children":3854},{},[3855],{"type":44,"value":3856},"JavaScript: obfuscator detection, density-based matching",{"type":38,"tag":360,"props":3858,"children":3859},{},[3860],{"type":44,"value":3861},"imp0rtp3, Nils Kuhnert",{"type":38,"tag":328,"props":3863,"children":3864},{},[3865,3874,3879],{"type":38,"tag":360,"props":3866,"children":3867},{},[3868],{"type":38,"tag":68,"props":3869,"children":3871},{"href":3870},"examples\u002FSUSP_CRX_SuspiciousPermissions.yar",[3872],{"type":44,"value":3873},"SUSP_CRX_SuspiciousPermissions.yar",{"type":38,"tag":360,"props":3875,"children":3876},{},[3877],{"type":44,"value":3878},"Chrome extensions: crx module, permissions",{"type":38,"tag":360,"props":3880,"children":3881},{},[3882],{"type":44,"value":3883},"Educational",{"type":38,"tag":77,"props":3885,"children":3887},{"id":3886},"scripts",[3888],{"type":44,"value":3889},"Scripts",{"type":38,"tag":661,"props":3891,"children":3893},{"className":2099,"code":3892,"language":2101,"meta":666,"style":666},"uv run {baseDir}\u002Fscripts\u002Fyara_lint.py rule.yar      # Validate style\u002Fmetadata\nuv run {baseDir}\u002Fscripts\u002Fatom_analyzer.py rule.yar  # Check string quality\n",[3894],{"type":38,"tag":129,"props":3895,"children":3896},{"__ignoreMap":666},[3897,3925],{"type":38,"tag":672,"props":3898,"children":3899},{"class":674,"line":675},[3900,3905,3910,3915,3920],{"type":38,"tag":672,"props":3901,"children":3902},{"style":2128},[3903],{"type":44,"value":3904},"uv",{"type":38,"tag":672,"props":3906,"children":3907},{"style":2134},[3908],{"type":44,"value":3909}," run",{"type":38,"tag":672,"props":3911,"children":3912},{"style":2134},[3913],{"type":44,"value":3914}," {baseDir}\u002Fscripts\u002Fyara_lint.py",{"type":38,"tag":672,"props":3916,"children":3917},{"style":2134},[3918],{"type":44,"value":3919}," rule.yar",{"type":38,"tag":672,"props":3921,"children":3922},{"style":2111},[3923],{"type":44,"value":3924},"      # Validate style\u002Fmetadata\n",{"type":38,"tag":672,"props":3926,"children":3927},{"class":674,"line":684},[3928,3932,3936,3941,3945],{"type":38,"tag":672,"props":3929,"children":3930},{"style":2128},[3931],{"type":44,"value":3904},{"type":38,"tag":672,"props":3933,"children":3934},{"style":2134},[3935],{"type":44,"value":3909},{"type":38,"tag":672,"props":3937,"children":3938},{"style":2134},[3939],{"type":44,"value":3940}," {baseDir}\u002Fscripts\u002Fatom_analyzer.py",{"type":38,"tag":672,"props":3942,"children":3943},{"style":2134},[3944],{"type":44,"value":3919},{"type":38,"tag":672,"props":3946,"children":3947},{"style":2111},[3948],{"type":44,"value":3949},"  # Check string quality\n",{"type":38,"tag":47,"props":3951,"children":3952},{},[3953,3954,3960],{"type":44,"value":2466},{"type":38,"tag":68,"props":3955,"children":3957},{"href":3956},"..\u002F..\u002FREADME.md#scripts",[3958],{"type":44,"value":3959},"README.md",{"type":44,"value":3961}," for detailed script documentation.",{"type":38,"tag":77,"props":3963,"children":3965},{"id":3964},"quality-checklist",[3966],{"type":44,"value":3967},"Quality Checklist",{"type":38,"tag":47,"props":3969,"children":3970},{},[3971],{"type":44,"value":3972},"Before deploying any rule:",{"type":38,"tag":154,"props":3974,"children":3977},{"className":3975},[3976],"contains-task-list",[3978,3998,4007,4016,4025,4034,4043,4059,4068,4077,4086,4101,4117,4126],{"type":38,"tag":88,"props":3979,"children":3982},{"className":3980},[3981],"task-list-item",[3983,3988,3990,3996],{"type":38,"tag":3984,"props":3985,"children":3987},"input",{"disabled":886,"type":3986},"checkbox",[],{"type":44,"value":3989}," Name follows ",{"type":38,"tag":129,"props":3991,"children":3993},{"className":3992},[],[3994],{"type":44,"value":3995},"{CATEGORY}_{PLATFORM}_{FAMILY}_{VARIANT}_{DATE}",{"type":44,"value":3997}," format",{"type":38,"tag":88,"props":3999,"children":4001},{"className":4000},[3981],[4002,4005],{"type":38,"tag":3984,"props":4003,"children":4004},{"disabled":886,"type":3986},[],{"type":44,"value":4006}," Description starts with \"Detects\" and explains what\u002Fhow",{"type":38,"tag":88,"props":4008,"children":4010},{"className":4009},[3981],[4011,4014],{"type":38,"tag":3984,"props":4012,"children":4013},{"disabled":886,"type":3986},[],{"type":44,"value":4015}," All required metadata present (author, reference, date)",{"type":38,"tag":88,"props":4017,"children":4019},{"className":4018},[3981],[4020,4023],{"type":38,"tag":3984,"props":4021,"children":4022},{"disabled":886,"type":3986},[],{"type":44,"value":4024}," Strings are unique (not API names, common paths, or format strings)",{"type":38,"tag":88,"props":4026,"children":4028},{"className":4027},[3981],[4029,4032],{"type":38,"tag":3984,"props":4030,"children":4031},{"disabled":886,"type":3986},[],{"type":44,"value":4033}," All strings have 4+ bytes with good atom potential",{"type":38,"tag":88,"props":4035,"children":4037},{"className":4036},[3981],[4038,4041],{"type":38,"tag":3984,"props":4039,"children":4040},{"disabled":886,"type":3986},[],{"type":44,"value":4042}," Base64 modifier only on strings with 3+ characters",{"type":38,"tag":88,"props":4044,"children":4046},{"className":4045},[3981],[4047,4050,4052,4057],{"type":38,"tag":3984,"props":4048,"children":4049},{"disabled":886,"type":3986},[],{"type":44,"value":4051}," Regex patterns have escaped ",{"type":38,"tag":129,"props":4053,"children":4055},{"className":4054},[],[4056],{"type":44,"value":2750},{"type":44,"value":4058}," and valid escape sequences",{"type":38,"tag":88,"props":4060,"children":4062},{"className":4061},[3981],[4063,4066],{"type":38,"tag":3984,"props":4064,"children":4065},{"disabled":886,"type":3986},[],{"type":44,"value":4067}," Condition starts with cheap checks (filesize, magic bytes)",{"type":38,"tag":88,"props":4069,"children":4071},{"className":4070},[3981],[4072,4075],{"type":38,"tag":3984,"props":4073,"children":4074},{"disabled":886,"type":3986},[],{"type":44,"value":4076}," Rule matches all target samples",{"type":38,"tag":88,"props":4078,"children":4080},{"className":4079},[3981],[4081,4084],{"type":38,"tag":3984,"props":4082,"children":4083},{"disabled":886,"type":3986},[],{"type":44,"value":4085}," Rule produces zero matches on goodware corpus",{"type":38,"tag":88,"props":4087,"children":4089},{"className":4088},[3981],[4090,4093,4094,4099],{"type":38,"tag":3984,"props":4091,"children":4092},{"disabled":886,"type":3986},[],{"type":44,"value":256},{"type":38,"tag":129,"props":4095,"children":4097},{"className":4096},[],[4098],{"type":44,"value":293},{"type":44,"value":4100}," passes with no errors",{"type":38,"tag":88,"props":4102,"children":4104},{"className":4103},[3981],[4105,4108,4109,4115],{"type":38,"tag":3984,"props":4106,"children":4107},{"disabled":886,"type":3986},[],{"type":44,"value":256},{"type":38,"tag":129,"props":4110,"children":4112},{"className":4111},[],[4113],{"type":44,"value":4114},"yr fmt --check",{"type":44,"value":4116}," passes (consistent formatting)",{"type":38,"tag":88,"props":4118,"children":4120},{"className":4119},[3981],[4121,4124],{"type":38,"tag":3984,"props":4122,"children":4123},{"disabled":886,"type":3986},[],{"type":44,"value":4125}," Linter passes with no errors",{"type":38,"tag":88,"props":4127,"children":4129},{"className":4128},[3981],[4130,4133],{"type":38,"tag":3984,"props":4131,"children":4132},{"disabled":886,"type":3986},[],{"type":44,"value":4134}," Peer review completed",{"type":38,"tag":77,"props":4136,"children":4138},{"id":4137},"resources",[4139],{"type":44,"value":4140},"Resources",{"type":38,"tag":641,"props":4142,"children":4144},{"id":4143},"quality-yara-rule-repositories",[4145],{"type":44,"value":4146},"Quality YARA Rule Repositories",{"type":38,"tag":47,"props":4148,"children":4149},{},[4150],{"type":44,"value":4151},"Learn from production rules. These repositories contain well-tested, properly attributed rules:",{"type":38,"tag":320,"props":4153,"children":4154},{},[4155,4176],{"type":38,"tag":324,"props":4156,"children":4157},{},[4158],{"type":38,"tag":328,"props":4159,"children":4160},{},[4161,4166,4171],{"type":38,"tag":332,"props":4162,"children":4163},{},[4164],{"type":44,"value":4165},"Repository",{"type":38,"tag":332,"props":4167,"children":4168},{},[4169],{"type":44,"value":4170},"Focus",{"type":38,"tag":332,"props":4172,"children":4173},{},[4174],{"type":44,"value":4175},"Maintainer",{"type":38,"tag":353,"props":4177,"children":4178},{},[4179,4203,4225,4248,4271],{"type":38,"tag":328,"props":4180,"children":4181},{},[4182,4193,4198],{"type":38,"tag":360,"props":4183,"children":4184},{},[4185],{"type":38,"tag":68,"props":4186,"children":4190},{"href":4187,"rel":4188},"https:\u002F\u002Fgithub.com\u002FNeo23x0\u002Fsignature-base",[4189],"nofollow",[4191],{"type":44,"value":4192},"Neo23x0\u002Fsignature-base",{"type":38,"tag":360,"props":4194,"children":4195},{},[4196],{"type":44,"value":4197},"17,000+ production rules, multi-platform",{"type":38,"tag":360,"props":4199,"children":4200},{},[4201],{"type":44,"value":4202},"Florian Roth",{"type":38,"tag":328,"props":4204,"children":4205},{},[4206,4216,4221],{"type":38,"tag":360,"props":4207,"children":4208},{},[4209],{"type":38,"tag":68,"props":4210,"children":4213},{"href":4211,"rel":4212},"https:\u002F\u002Fgithub.com\u002Felastic\u002Fprotections-artifacts",[4189],[4214],{"type":44,"value":4215},"Elastic\u002Fprotections-artifacts",{"type":38,"tag":360,"props":4217,"children":4218},{},[4219],{"type":44,"value":4220},"1,000+ endpoint-tested rules",{"type":38,"tag":360,"props":4222,"children":4223},{},[4224],{"type":44,"value":3795},{"type":38,"tag":328,"props":4226,"children":4227},{},[4228,4238,4243],{"type":38,"tag":360,"props":4229,"children":4230},{},[4231],{"type":38,"tag":68,"props":4232,"children":4235},{"href":4233,"rel":4234},"https:\u002F\u002Fgithub.com\u002Freversinglabs\u002Freversinglabs-yara-rules",[4189],[4236],{"type":44,"value":4237},"reversinglabs\u002Freversinglabs-yara-rules",{"type":38,"tag":360,"props":4239,"children":4240},{},[4241],{"type":44,"value":4242},"Threat research rules",{"type":38,"tag":360,"props":4244,"children":4245},{},[4246],{"type":44,"value":4247},"ReversingLabs",{"type":38,"tag":328,"props":4249,"children":4250},{},[4251,4261,4266],{"type":38,"tag":360,"props":4252,"children":4253},{},[4254],{"type":38,"tag":68,"props":4255,"children":4258},{"href":4256,"rel":4257},"https:\u002F\u002Fgithub.com\u002Fimp0rtp3\u002Fjs-yara-rules",[4189],[4259],{"type":44,"value":4260},"imp0rtp3\u002Fjs-yara-rules",{"type":38,"tag":360,"props":4262,"children":4263},{},[4264],{"type":44,"value":4265},"JavaScript\u002Fbrowser malware",{"type":38,"tag":360,"props":4267,"children":4268},{},[4269],{"type":44,"value":4270},"imp0rtp3",{"type":38,"tag":328,"props":4272,"children":4273},{},[4274,4284,4289],{"type":38,"tag":360,"props":4275,"children":4276},{},[4277],{"type":38,"tag":68,"props":4278,"children":4281},{"href":4279,"rel":4280},"https:\u002F\u002Fgithub.com\u002FInQuest\u002Fawesome-yara",[4189],[4282],{"type":44,"value":4283},"InQuest\u002Fawesome-yara",{"type":38,"tag":360,"props":4285,"children":4286},{},[4287],{"type":44,"value":4288},"Curated index of resources",{"type":38,"tag":360,"props":4290,"children":4291},{},[4292],{"type":44,"value":4293},"InQuest",{"type":38,"tag":641,"props":4295,"children":4297},{"id":4296},"style-performance-guides",[4298],{"type":44,"value":4299},"Style & Performance Guides",{"type":38,"tag":320,"props":4301,"children":4302},{},[4303,4318],{"type":38,"tag":324,"props":4304,"children":4305},{},[4306],{"type":38,"tag":328,"props":4307,"children":4308},{},[4309,4314],{"type":38,"tag":332,"props":4310,"children":4311},{},[4312],{"type":44,"value":4313},"Guide",{"type":38,"tag":332,"props":4315,"children":4316},{},[4317],{"type":44,"value":1121},{"type":38,"tag":353,"props":4319,"children":4320},{},[4321,4339,4357],{"type":38,"tag":328,"props":4322,"children":4323},{},[4324,4334],{"type":38,"tag":360,"props":4325,"children":4326},{},[4327],{"type":38,"tag":68,"props":4328,"children":4331},{"href":4329,"rel":4330},"https:\u002F\u002Fgithub.com\u002FNeo23x0\u002FYARA-Style-Guide",[4189],[4332],{"type":44,"value":4333},"YARA Style Guide",{"type":38,"tag":360,"props":4335,"children":4336},{},[4337],{"type":44,"value":4338},"Naming conventions, metadata, string prefixes",{"type":38,"tag":328,"props":4340,"children":4341},{},[4342,4352],{"type":38,"tag":360,"props":4343,"children":4344},{},[4345],{"type":38,"tag":68,"props":4346,"children":4349},{"href":4347,"rel":4348},"https:\u002F\u002Fgithub.com\u002FNeo23x0\u002FYARA-Performance-Guidelines",[4189],[4350],{"type":44,"value":4351},"YARA Performance Guidelines",{"type":38,"tag":360,"props":4353,"children":4354},{},[4355],{"type":44,"value":4356},"Atom optimization, regex bounds",{"type":38,"tag":328,"props":4358,"children":4359},{},[4360,4370],{"type":38,"tag":360,"props":4361,"children":4362},{},[4363],{"type":38,"tag":68,"props":4364,"children":4367},{"href":4365,"rel":4366},"https:\u002F\u002Fyara.readthedocs.io\u002F",[4189],[4368],{"type":44,"value":4369},"Kaspersky Applied YARA Training",{"type":38,"tag":360,"props":4371,"children":4372},{},[4373],{"type":44,"value":4374},"Expert techniques from production use",{"type":38,"tag":641,"props":4376,"children":4378},{"id":4377},"tools",[4379],{"type":44,"value":4380},"Tools",{"type":38,"tag":320,"props":4382,"children":4383},{},[4384,4398],{"type":38,"tag":324,"props":4385,"children":4386},{},[4387],{"type":38,"tag":328,"props":4388,"children":4389},{},[4390,4394],{"type":38,"tag":332,"props":4391,"children":4392},{},[4393],{"type":44,"value":1116},{"type":38,"tag":332,"props":4395,"children":4396},{},[4397],{"type":44,"value":1121},{"type":38,"tag":353,"props":4399,"children":4400},{},[4401,4418,4435,4452],{"type":38,"tag":328,"props":4402,"children":4403},{},[4404,4413],{"type":38,"tag":360,"props":4405,"children":4406},{},[4407],{"type":38,"tag":68,"props":4408,"children":4411},{"href":4409,"rel":4410},"https:\u002F\u002Fgithub.com\u002FNeo23x0\u002FyarGen",[4189],[4412],{"type":44,"value":1135},{"type":38,"tag":360,"props":4414,"children":4415},{},[4416],{"type":44,"value":4417},"Extract candidate strings from samples",{"type":38,"tag":328,"props":4419,"children":4420},{},[4421,4430],{"type":38,"tag":360,"props":4422,"children":4423},{},[4424],{"type":38,"tag":68,"props":4425,"children":4428},{"href":4426,"rel":4427},"https:\u002F\u002Fgithub.com\u002Fmandiant\u002Fflare-floss",[4189],[4429],{"type":44,"value":1164},{"type":38,"tag":360,"props":4431,"children":4432},{},[4433],{"type":44,"value":4434},"Extract obfuscated and stack strings",{"type":38,"tag":328,"props":4436,"children":4437},{},[4438,4447],{"type":38,"tag":360,"props":4439,"children":4440},{},[4441],{"type":38,"tag":68,"props":4442,"children":4445},{"href":4443,"rel":4444},"https:\u002F\u002Fyara-ci.cloud.virustotal.com\u002F",[4189],[4446],{"type":44,"value":1241},{"type":38,"tag":360,"props":4448,"children":4449},{},[4450],{"type":44,"value":4451},"Automated goodware testing",{"type":38,"tag":328,"props":4453,"children":4454},{},[4455,4465],{"type":38,"tag":360,"props":4456,"children":4457},{},[4458],{"type":38,"tag":68,"props":4459,"children":4462},{"href":4460,"rel":4461},"https:\u002F\u002Fyaradbg.dev",[4189],[4463],{"type":44,"value":4464},"YaraDbg",{"type":38,"tag":360,"props":4466,"children":4467},{},[4468],{"type":44,"value":4469},"Web-based rule debugger",{"type":38,"tag":641,"props":4471,"children":4473},{"id":4472},"macos-specific-resources",[4474],{"type":44,"value":4475},"macOS-Specific Resources",{"type":38,"tag":320,"props":4477,"children":4478},{},[4479,4494],{"type":38,"tag":324,"props":4480,"children":4481},{},[4482],{"type":38,"tag":328,"props":4483,"children":4484},{},[4485,4490],{"type":38,"tag":332,"props":4486,"children":4487},{},[4488],{"type":44,"value":4489},"Resource",{"type":38,"tag":332,"props":4491,"children":4492},{},[4493],{"type":44,"value":1121},{"type":38,"tag":353,"props":4495,"children":4496},{},[4497,4516,4534],{"type":38,"tag":328,"props":4498,"children":4499},{},[4500,4505],{"type":38,"tag":360,"props":4501,"children":4502},{},[4503],{"type":44,"value":4504},"Apple XProtect",{"type":38,"tag":360,"props":4506,"children":4507},{},[4508,4510],{"type":44,"value":4509},"Production macOS rules at ",{"type":38,"tag":129,"props":4511,"children":4513},{"className":4512},[],[4514],{"type":44,"value":4515},"\u002FSystem\u002FLibrary\u002FCoreServices\u002FXProtect.bundle\u002F",{"type":38,"tag":328,"props":4517,"children":4518},{},[4519,4529],{"type":38,"tag":360,"props":4520,"children":4521},{},[4522],{"type":38,"tag":68,"props":4523,"children":4526},{"href":4524,"rel":4525},"https:\u002F\u002Fobjective-see.org\u002F",[4189],[4527],{"type":44,"value":4528},"objective-see",{"type":38,"tag":360,"props":4530,"children":4531},{},[4532],{"type":44,"value":4533},"macOS malware research and samples",{"type":38,"tag":328,"props":4535,"children":4536},{},[4537,4547],{"type":38,"tag":360,"props":4538,"children":4539},{},[4540],{"type":38,"tag":68,"props":4541,"children":4544},{"href":4542,"rel":4543},"https:\u002F\u002Fgithub.com\u002F0xmachos\u002Fmacos-security-tools",[4189],[4545],{"type":44,"value":4546},"macOS Security Tools",{"type":38,"tag":360,"props":4548,"children":4549},{},[4550],{"type":44,"value":4551},"Reference list",{"type":38,"tag":641,"props":4553,"children":4555},{"id":4554},"multi-indicator-clustering-pattern",[4556],{"type":44,"value":4557},"Multi-Indicator Clustering Pattern",{"type":38,"tag":47,"props":4559,"children":4560},{},[4561],{"type":44,"value":4562},"Production rules often group indicators by type:",{"type":38,"tag":661,"props":4564,"children":4566},{"className":663,"code":4565,"language":665,"meta":666,"style":666},"strings:\n    \u002F\u002F Category A: Library indicators\n    $a1 = \"SRWebSocket\" ascii\n    $a2 = \"SocketRocket\" ascii\n\n    \u002F\u002F Category B: Behavioral indicators\n    $b1 = \"SSH tunnel\" ascii\n    $b2 = \"keylogger\" ascii nocase\n\n    \u002F\u002F Category C: C2 patterns\n    $c1 = \u002Fhttps:\\\u002F\\\u002F[a-z0-9]{8,16}\\.onion\u002F\n\ncondition:\n    filesize \u003C 10MB and\n    any of ($a*) and any of ($b*)  \u002F\u002F Require evidence from BOTH categories\n",[4567],{"type":38,"tag":129,"props":4568,"children":4569},{"__ignoreMap":666},[4570,4578,4586,4594,4602,4609,4617,4625,4633,4640,4648,4656,4663,4671,4679],{"type":38,"tag":672,"props":4571,"children":4572},{"class":674,"line":675},[4573],{"type":38,"tag":672,"props":4574,"children":4575},{},[4576],{"type":44,"value":4577},"strings:\n",{"type":38,"tag":672,"props":4579,"children":4580},{"class":674,"line":684},[4581],{"type":38,"tag":672,"props":4582,"children":4583},{},[4584],{"type":44,"value":4585},"    \u002F\u002F Category A: Library indicators\n",{"type":38,"tag":672,"props":4587,"children":4588},{"class":674,"line":693},[4589],{"type":38,"tag":672,"props":4590,"children":4591},{},[4592],{"type":44,"value":4593},"    $a1 = \"SRWebSocket\" ascii\n",{"type":38,"tag":672,"props":4595,"children":4596},{"class":674,"line":702},[4597],{"type":38,"tag":672,"props":4598,"children":4599},{},[4600],{"type":44,"value":4601},"    $a2 = \"SocketRocket\" ascii\n",{"type":38,"tag":672,"props":4603,"children":4604},{"class":674,"line":711},[4605],{"type":38,"tag":672,"props":4606,"children":4607},{"emptyLinePlaceholder":886},[4608],{"type":44,"value":889},{"type":38,"tag":672,"props":4610,"children":4611},{"class":674,"line":720},[4612],{"type":38,"tag":672,"props":4613,"children":4614},{},[4615],{"type":44,"value":4616},"    \u002F\u002F Category B: Behavioral indicators\n",{"type":38,"tag":672,"props":4618,"children":4619},{"class":674,"line":882},[4620],{"type":38,"tag":672,"props":4621,"children":4622},{},[4623],{"type":44,"value":4624},"    $b1 = \"SSH tunnel\" ascii\n",{"type":38,"tag":672,"props":4626,"children":4627},{"class":674,"line":892},[4628],{"type":38,"tag":672,"props":4629,"children":4630},{},[4631],{"type":44,"value":4632},"    $b2 = \"keylogger\" ascii nocase\n",{"type":38,"tag":672,"props":4634,"children":4635},{"class":674,"line":901},[4636],{"type":38,"tag":672,"props":4637,"children":4638},{"emptyLinePlaceholder":886},[4639],{"type":44,"value":889},{"type":38,"tag":672,"props":4641,"children":4642},{"class":674,"line":910},[4643],{"type":38,"tag":672,"props":4644,"children":4645},{},[4646],{"type":44,"value":4647},"    \u002F\u002F Category C: C2 patterns\n",{"type":38,"tag":672,"props":4649,"children":4650},{"class":674,"line":919},[4651],{"type":38,"tag":672,"props":4652,"children":4653},{},[4654],{"type":44,"value":4655},"    $c1 = \u002Fhttps:\\\u002F\\\u002F[a-z0-9]{8,16}\\.onion\u002F\n",{"type":38,"tag":672,"props":4657,"children":4658},{"class":674,"line":927},[4659],{"type":38,"tag":672,"props":4660,"children":4661},{"emptyLinePlaceholder":886},[4662],{"type":44,"value":889},{"type":38,"tag":672,"props":4664,"children":4665},{"class":674,"line":936},[4666],{"type":38,"tag":672,"props":4667,"children":4668},{},[4669],{"type":44,"value":4670},"condition:\n",{"type":38,"tag":672,"props":4672,"children":4673},{"class":674,"line":945},[4674],{"type":38,"tag":672,"props":4675,"children":4676},{},[4677],{"type":44,"value":4678},"    filesize \u003C 10MB and\n",{"type":38,"tag":672,"props":4680,"children":4681},{"class":674,"line":954},[4682],{"type":38,"tag":672,"props":4683,"children":4684},{},[4685],{"type":44,"value":4686},"    any of ($a*) and any of ($b*)  \u002F\u002F Require evidence from BOTH categories\n",{"type":38,"tag":47,"props":4688,"children":4689},{},[4690,4695,4697,4703,4704,4710,4711,4717],{"type":38,"tag":60,"props":4691,"children":4692},{},[4693],{"type":44,"value":4694},"Why this works:",{"type":44,"value":4696}," Different indicator types have different confidence levels. A single C2 domain might be definitive, while you need multiple library imports to be confident. Grouping by ",{"type":38,"tag":129,"props":4698,"children":4700},{"className":4699},[],[4701],{"type":44,"value":4702},"$a*",{"type":44,"value":287},{"type":38,"tag":129,"props":4705,"children":4707},{"className":4706},[],[4708],{"type":44,"value":4709},"$b*",{"type":44,"value":287},{"type":38,"tag":129,"props":4712,"children":4714},{"className":4713},[],[4715],{"type":44,"value":4716},"$c*",{"type":44,"value":4718}," lets you express graduated requirements.",{"type":38,"tag":4720,"props":4721,"children":4722},"style",{},[4723],{"type":44,"value":4724},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":4726,"total":4822},[4727,4744,4754,4772,4787,4800,4812],{"slug":4728,"name":4728,"fn":4729,"description":4730,"org":4731,"tags":4732,"stars":20,"repoUrl":21,"updatedAt":4743},"address-sanitizer","detect memory errors during fuzzing","AddressSanitizer detects memory errors during fuzzing. Use when fuzzing C\u002FC++ code to find buffer overflows and use-after-free bugs.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4733,4736,4739,4740],{"name":4734,"slug":4735,"type":16},"C#","c",{"name":4737,"slug":4738,"type":16},"Debugging","debugging",{"name":14,"slug":15,"type":16},{"name":4741,"slug":4742,"type":16},"Testing","testing","2026-07-17T06:05:14.925095",{"slug":4745,"name":4745,"fn":4746,"description":4747,"org":4748,"tags":4749,"stars":20,"repoUrl":21,"updatedAt":4753},"aflpp","perform multi-core fuzzing of C\u002FC++ projects","AFL++ is a fork of AFL with better fuzzing performance and advanced features. Use for multi-core fuzzing of C\u002FC++ projects.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4750,4751,4752],{"name":4734,"slug":4735,"type":16},{"name":14,"slug":15,"type":16},{"name":4741,"slug":4742,"type":16},"2026-07-17T06:05:12.433192",{"slug":4755,"name":4755,"fn":4756,"description":4757,"org":4758,"tags":4759,"stars":20,"repoUrl":21,"updatedAt":4771},"agentic-actions-auditor","audit GitHub Actions for security vulnerabilities","Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI\u002FCD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI\u002FCD pipeline security for prompt injection risks, or evaluating agentic action configurations.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4760,4763,4766,4767,4770],{"name":4761,"slug":4762,"type":16},"Agents","agents",{"name":4764,"slug":4765,"type":16},"CI\u002FCD","ci-cd",{"name":18,"slug":19,"type":16},{"name":4768,"slug":4769,"type":16},"GitHub Actions","github-actions",{"name":14,"slug":15,"type":16},"2026-07-18T05:47:48.564744",{"slug":4773,"name":4773,"fn":4774,"description":4775,"org":4776,"tags":4777,"stars":20,"repoUrl":21,"updatedAt":4786},"algorand-vulnerability-scanner","scan Algorand smart contracts for vulnerabilities","Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL\u002FPyTeal).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4778,4781,4782,4783],{"name":4779,"slug":4780,"type":16},"Audit","audit",{"name":18,"slug":19,"type":16},{"name":14,"slug":15,"type":16},{"name":4784,"slug":4785,"type":16},"Smart Contracts","smart-contracts","2026-07-18T05:47:43.989063",{"slug":4788,"name":4788,"fn":4789,"description":4790,"org":4791,"tags":4792,"stars":20,"repoUrl":21,"updatedAt":4799},"ask-questions-if-underspecified","clarify requirements before implementation","Clarify requirements before implementing. Use when serious doubts arise.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4793,4796],{"name":4794,"slug":4795,"type":16},"Engineering","engineering",{"name":4797,"slug":4798,"type":16},"Productivity","productivity","2026-07-17T06:05:33.543262",{"slug":4801,"name":4801,"fn":4802,"description":4803,"org":4804,"tags":4805,"stars":20,"repoUrl":21,"updatedAt":4811},"atheris","fuzz Python code with Atheris","Atheris is a coverage-guided Python fuzzer based on libFuzzer. Use for fuzzing pure Python code and Python C extensions.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4806,4809,4810],{"name":4807,"slug":4808,"type":16},"Python","python",{"name":14,"slug":15,"type":16},{"name":4741,"slug":4742,"type":16},"2026-07-17T06:05:14.575191",{"slug":4813,"name":4813,"fn":4814,"description":4815,"org":4816,"tags":4817,"stars":20,"repoUrl":21,"updatedAt":4821},"audit-augmentation","augment code graphs with audit findings","Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, importing binary graph findings, cross-referencing Semgrep, CodeQL, or binary-analysis findings with call graph data, or visualizing audit findings in the context of code structure.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4818,4819,4820],{"name":4779,"slug":4780,"type":16},{"name":18,"slug":19,"type":16},{"name":14,"slug":15,"type":16},"2026-08-01T05:44:54.920542",77,{"items":4824,"total":4928},[4825,4832,4838,4846,4853,4858,4864,4870,4883,4894,4906,4917],{"slug":4728,"name":4728,"fn":4729,"description":4730,"org":4826,"tags":4827,"stars":20,"repoUrl":21,"updatedAt":4743},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4828,4829,4830,4831],{"name":4734,"slug":4735,"type":16},{"name":4737,"slug":4738,"type":16},{"name":14,"slug":15,"type":16},{"name":4741,"slug":4742,"type":16},{"slug":4745,"name":4745,"fn":4746,"description":4747,"org":4833,"tags":4834,"stars":20,"repoUrl":21,"updatedAt":4753},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4835,4836,4837],{"name":4734,"slug":4735,"type":16},{"name":14,"slug":15,"type":16},{"name":4741,"slug":4742,"type":16},{"slug":4755,"name":4755,"fn":4756,"description":4757,"org":4839,"tags":4840,"stars":20,"repoUrl":21,"updatedAt":4771},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4841,4842,4843,4844,4845],{"name":4761,"slug":4762,"type":16},{"name":4764,"slug":4765,"type":16},{"name":18,"slug":19,"type":16},{"name":4768,"slug":4769,"type":16},{"name":14,"slug":15,"type":16},{"slug":4773,"name":4773,"fn":4774,"description":4775,"org":4847,"tags":4848,"stars":20,"repoUrl":21,"updatedAt":4786},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4849,4850,4851,4852],{"name":4779,"slug":4780,"type":16},{"name":18,"slug":19,"type":16},{"name":14,"slug":15,"type":16},{"name":4784,"slug":4785,"type":16},{"slug":4788,"name":4788,"fn":4789,"description":4790,"org":4854,"tags":4855,"stars":20,"repoUrl":21,"updatedAt":4799},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4856,4857],{"name":4794,"slug":4795,"type":16},{"name":4797,"slug":4798,"type":16},{"slug":4801,"name":4801,"fn":4802,"description":4803,"org":4859,"tags":4860,"stars":20,"repoUrl":21,"updatedAt":4811},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4861,4862,4863],{"name":4807,"slug":4808,"type":16},{"name":14,"slug":15,"type":16},{"name":4741,"slug":4742,"type":16},{"slug":4813,"name":4813,"fn":4814,"description":4815,"org":4865,"tags":4866,"stars":20,"repoUrl":21,"updatedAt":4821},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4867,4868,4869],{"name":4779,"slug":4780,"type":16},{"name":18,"slug":19,"type":16},{"name":14,"slug":15,"type":16},{"slug":4871,"name":4871,"fn":4872,"description":4873,"org":4874,"tags":4875,"stars":20,"repoUrl":21,"updatedAt":4882},"audit-context-building","build architectural context for code analysis","Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4876,4879,4880,4881],{"name":4877,"slug":4878,"type":16},"Architecture","architecture",{"name":4779,"slug":4780,"type":16},{"name":18,"slug":19,"type":16},{"name":4794,"slug":4795,"type":16},"2026-07-18T05:47:40.122449",{"slug":4884,"name":4884,"fn":4885,"description":4886,"org":4887,"tags":4888,"stars":20,"repoUrl":21,"updatedAt":4893},"audit-prep-assistant","prepare codebases for security audits","Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4889,4890,4891,4892],{"name":4779,"slug":4780,"type":16},{"name":18,"slug":19,"type":16},{"name":4794,"slug":4795,"type":16},{"name":14,"slug":15,"type":16},"2026-07-18T05:47:39.210985",{"slug":4895,"name":4895,"fn":4896,"description":4897,"org":4898,"tags":4899,"stars":20,"repoUrl":21,"updatedAt":4905},"burpsuite-project-parser","parse Burp Suite project files","Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy history or site map data, or analyzing HTTP traffic captured in a Burp project.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4900,4901,4904],{"name":4779,"slug":4780,"type":16},{"name":4902,"slug":4903,"type":16},"CLI","cli",{"name":14,"slug":15,"type":16},"2026-07-17T06:05:33.198077",{"slug":4907,"name":4907,"fn":4908,"description":4909,"org":4910,"tags":4911,"stars":20,"repoUrl":21,"updatedAt":4916},"c-review","audit C and C++ code","Performs comprehensive C\u002FC++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C\u002FC++ applications, reviewing daemons or services for memory safety, or hunting integer overflow \u002F use-after-free \u002F race conditions in userspace code.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4912,4913,4914,4915],{"name":4779,"slug":4780,"type":16},{"name":4734,"slug":4735,"type":16},{"name":18,"slug":19,"type":16},{"name":14,"slug":15,"type":16},"2026-07-17T06:05:11.333374",{"slug":4918,"name":4918,"fn":4919,"description":4920,"org":4921,"tags":4922,"stars":20,"repoUrl":21,"updatedAt":4927},"cairo-vulnerability-scanner","scan Cairo and StarkNet contracts for vulnerabilities","Scans Cairo\u002FStarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4923,4924,4925,4926],{"name":4779,"slug":4780,"type":16},{"name":18,"slug":19,"type":16},{"name":14,"slug":15,"type":16},{"name":4784,"slug":4785,"type":16},"2026-07-18T05:47:42.84568",111]