DOKK / manpages / debian 11 / yara / yara.1.en
yara(1) General Commands Manual yara(1)

yara - find files matching patterns and rules written in a special-purpose language.

yara [OPTION]... [NAMESPACE:]RULES_FILE... FILE | DIR | PID

yara scans the given FILE, all files contained in directory DIR, or the process identified by PID looking for matches of patterns and rules provided in a special purpose-language. The rules are read from one or more RULES_FILE.

The options to yara(1) are:

Path to a file with the atom quality table.
RULES_FILE contains rules already compiled with yarac.
Print number of matches only.
Define an external variable. This option can be used multiple times.
Treat warnings as errors. Has no effect if used with --no-warnings.
Speeds up scanning by searching only for the first occurrence of each pattern.
Print rules named identifier and ignore the rest. This option can be used multiple times.
Abort scanning after a number of rules matched.
Set maximum number of strings per rule (default=10000)
Pass file's content as extra data to module. This option can be used multiple times.
Print rules that doesn't apply (negate).
Disable warnings.
Print metadata associated to the rule.
Print module data.
Print namespace associated to the rule.
Print rules' statistics.
Print strings found in the file.
Print length of strings found in the file.
Print the tags associated to the rule.
Scan files in directories recursively. It follows symlinks.
Scan files listed in FILE, one per line.
Set maximum stack size to the specified number of slots.
Print rules tagged as tag and ignore the rest. This option can be used multiple times.
Use the specified number of threads to scan a directory.
Abort scanning after a number of seconds has elapsed.
Show version information.

$ yara /foo/bar/rules .

Apply rules on /foo/bar/rules to all files on current directory. Subdirectories are not scanned.

$ yara -t Packer -t Compiler /foo/bar/rules bazfile

Apply rules on /foo/bar/rules to bazfile. Only reports rules tagged as Packer or Compiler.

$ cat /foo/bar/rules | yara -r /foo

Scan all files in the /foo directory and its subdirectories. Rules are read from standard input.

$ yara -d mybool=true -d myint=5 -d mystring="my string" /foo/bar/rules bazfile

Defines three external variables mybool myint and mystring.

$ yara -x cuckoo=cuckoo_json_report /foo/bar/rules bazfile

Apply rules on /foo/bar/rules to bazfile while passing the content of cuckoo_json_report to the cuckoo module.

Victor M. Alvarez <plusvic@gmail.com>;<vmalvarez@virustotal.com>

September 22, 2008 Victor M. Alvarez