|
1 | | ---- |
2 | | -title: "Getting started" |
3 | | -description: "Guides lead a user through a specific task they want to accomplish, often with a sequence of steps." |
4 | | -summary: "" |
5 | | -date: 2023-09-07T16:04:48+02:00 |
6 | | -lastmod: 2023-09-07T16:04:48+02:00 |
7 | | -draft: false |
8 | | -menu: |
9 | | - docs: |
10 | | - parent: "" |
11 | | - identifier: "getting_started" |
12 | | -weight: 110 |
13 | | -toc: true |
14 | | -seo: |
15 | | - title: "" # custom title (optional) |
16 | | - description: "" # custom description (recommended) |
17 | | - canonical: "" # custom canonical URL (optional) |
18 | | - noindex: false # false (default) or true |
19 | | ---- |
20 | | - |
21 | | - |
22 | | -YARA-X is a re-incarnation of [YARA](https://virustotal.github.io/yara), a |
23 | | -pattern matching tool designed with malware researchers in mind. This new |
24 | | -incarnation intends to be faster, safer and more user-friendly than its |
25 | | -predecessor. The ultimate goal of YARA-X is replacing YARA as the default |
26 | | -pattern matching tool for malware researchers. |
27 | | - |
28 | | -With YARA-X you can create descriptions of malware families (or whatever you |
29 | | -want to describe) based on textual or binary patterns. Each description (a.k.a. |
30 | | -rule) consists of a set of patterns and a boolean expression which determine its |
31 | | -logic. Let's see an example: |
32 | | - |
33 | | -```yara |
34 | | -rule silent_banker : banker { |
35 | | - meta: |
36 | | - description = "This is just an example" |
37 | | - threat_level = 3 |
38 | | - in_the_wild = true |
39 | | -
|
40 | | - strings: |
41 | | - $a = {6A 40 68 00 30 00 00 6A 14 8D 91} |
42 | | - $b = {8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9} |
43 | | - $c = "UVODFRYSIHLNWPEJXQZAKCBGMT" |
44 | | -
|
45 | | - condition: |
46 | | - $a or $b or $c |
47 | | -} |
48 | | -``` |
49 | | - |
50 | | -## Further reading |
51 | | - |
52 | | -- If you are completely new to YARA, you should start by |
53 | | - learning [how to write YARA rules]({{< ref "syntax.md" >}}). |
54 | | - |
55 | | -- Seasoned YARA users may want to know about the |
| 1 | +--- |
| 2 | +title: "Getting started" |
| 3 | +description: "Guides lead a user through a specific task they want to accomplish, often with a sequence of steps." |
| 4 | +summary: "" |
| 5 | +date: 2023-09-07T16:04:48+02:00 |
| 6 | +lastmod: 2023-09-07T16:04:48+02:00 |
| 7 | +draft: false |
| 8 | +menu: |
| 9 | + docs: |
| 10 | + parent: "" |
| 11 | + identifier: "getting_started" |
| 12 | +weight: 110 |
| 13 | +toc: true |
| 14 | +seo: |
| 15 | + title: "" # custom title (optional) |
| 16 | + description: "" # custom description (recommended) |
| 17 | + canonical: "" # custom canonical URL (optional) |
| 18 | + noindex: false # false (default) or true |
| 19 | +--- |
| 20 | + |
| 21 | + |
| 22 | +YARA-X is a re-incarnation of [YARA](https://virustotal.github.io/yara), a |
| 23 | +pattern matching tool designed with malware researchers in mind. This new |
| 24 | +incarnation intends to be faster, safer and more user-friendly than its |
| 25 | +predecessor. The ultimate goal of YARA-X is replacing YARA as the default |
| 26 | +pattern matching tool for malware researchers. |
| 27 | + |
| 28 | +With YARA-X you can create descriptions of malware families (or whatever you |
| 29 | +want to describe) based on textual or binary patterns. Each description (a.k.a. |
| 30 | +rule) consists of a set of patterns and a boolean expression which determine its |
| 31 | +logic. Let's see an example: |
| 32 | + |
| 33 | +```yara |
| 34 | +rule silent_banker : banker { |
| 35 | + meta: |
| 36 | + description = "This is just an example" |
| 37 | + threat_level = 3 |
| 38 | + in_the_wild = true |
| 39 | +
|
| 40 | + strings: |
| 41 | + $a = {6A 40 68 00 30 00 00 6A 14 8D 91} |
| 42 | + $b = {8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9} |
| 43 | + $c = "UVODFRYSIHLNWPEJXQZAKCBGMT" |
| 44 | +
|
| 45 | + condition: |
| 46 | + $a or $b or $c |
| 47 | +} |
| 48 | +``` |
| 49 | + |
| 50 | +## Further reading |
| 51 | + |
| 52 | +- If you are completely new to YARA, you should start by |
| 53 | + learning [how to write YARA rules]({{< ref "syntax.md" >}}). |
| 54 | + |
| 55 | +- Seasoned YARA users may want to know about the |
56 | 56 | [differences between YARA-X and YARA]({{< ref "differences.md" >}}) |
0 commit comments