yara-rule-authoring
Guides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules. Covers naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive reduction. Triggers on: YARA, YARA-X, malware detection, threat hunting, IOC, signature, crx module, dex module.
npx skills add trailofbits/skills --skill yara-rule-authoring --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# YARA-X Rule Authoring Write detection rules that catch malware without drowning in false positives. > **This skill targets YARA-X**, the Rust-based successor to legacy YARA. YARA-X powers VirusTotal's production systems and is the recommended implementation. See [Migrating from Legacy YARA](#migrating-from-legacy-yara) if you have existing rules. ## Core Principles 1. **Strings must generate good atoms** — YARA extracts 4-byte subsequences for fast matching. Strings with repeated bytes, common sequences, or under 4 bytes force slow bytecode verification on too many files. 2. **Target specific families, not categories** — "Detects ransomware" catches everything and nothing. "Detects LockBit 3.0 configuration extraction routine" catches what you want. 3. **Test against goodware before deployment** — A rule that fires on Windows system files is useless. Validate against VirusTotal's goodware corpus or your own clean file set. 4. **Short-circuit with cheap checks first** — Put `filesize < 10MB and uint16(0) == 0x5A4D` before expensive string searches or module calls. 5. **Metadata is documentation** — Future you (and your team) need to know what this catches, why, and where the sampl
- Core Principles
- When to Use
- When NOT to Use
- YARA-X Overview
- Platform Considerations
- macOS Malware Detection
- JavaScript Detection Decision Tree
- Essential Toolkit
- Rationalizations to Reject
- Decision Trees
- Is This String Good Enough?
- When to Use "all of" vs "any of"
- When to Abandon a Rule Approach
- Debugging False Positives
yr check rule.yar
yr fmt -w rule.yar
yr dump -m pe sample.exe --output-format yaml
time yr scan -s rule.yar corpus/
yr check --relaxed-re-syntax rules/ # Identify issues
Fix each issue, then:
yr check rules/ # Verify without relaxed mode
uv run {baseDir}/scripts/yara_lint.py rule.yar # Validate style/metadata
uv run {baseDir}/scripts/atom_analyzer.py rule.yar # Check string qualityWhat does the yara-rule-authoring skill do?
Guides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules. Covers naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive reduction. Triggers on: YARA, YARA-X, malware detection, threat hunting, IOC, signature, crx module, dex module.
How do I install it?
Run `npx skills add trailofbits/skills --skill yara-rule-authoring --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From trailofbits/skills, a repository with 6,426 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.