YARA
Named by 64 kept items in this workspace.
42 items name it under tools and 22 under classification.technologies.
Search every workspace for YARA. It matches the name as written, so it can find other things that share it.
The items that name it 64
Three-tier ontology in CAIRN: T1 for AI artifacts, T2 for behavioral context, T3 for family attribution.
Rules G_APT_Downloader_CROSSROAD_1, G_APT_Backdoor_SHINYROAD_1, G_APT_Backdoor_SHINYROAD_2 and G_APT_Launcher_ADAPTAGENT_1 published by Mandiant for detection
A YARA rule is provided to discover PEERSTITCH activity.
Suggested as capable of catching the Ghost Dev gems' network fetch calls even with simplistic rules.
Rule format used by CAIRN (validated via 'cairn validate-rules') to match AI-related strings/behaviors in samples
Used to create a detection rule from 24 extracted SLAPSHOT samples (rule included at end of article).
GTIG rules G_APT_Backdoorwebshell_WHIPSHOT_1, G_APT_Tunneler_SLAPSHOT_1, G_Hunting_Config_NetScaler_PHP_1, G_Hunting_Backdoorwebshell_NetScaler_C2Headers_1 and G_Hunting_Script_NetScaler_Persistence_1 detect the web shells, tunneler, config changes and persistence scripts
Detection rule (CLOSEDQUORUM_LLM_Autonomous_Implant) provided by CAIRN to detect the implant via strings, DWARF function names, system prompt, and VT metadata anchors
Rule-based matching engine used within CAIRN across a three-tier ontology (T1 primitive artifacts, T2 behavioral context, T3 operational family attribution); runs automatically on import and via 'cairn rescan' to re-apply rules offline against the full corpus
Supported detection rule format for local import
Signature-based malware identification; page provides a YARA rule (MAL_BlueMoon_ExploitKit) authored by Greg Lesnewich to detect BlueMoon exploit kit artifacts.
Rules M_Utility_REALBREEZE_2, G_Tunneler_COBALTSPIN_1, G_Backdoor_BOATBEAM_1 and G_Backdoor_MILDFROST_1 detect the malware
Pattern matching rules tool bundled in re-shell
Used to write a detection rule (targeted_DarkCaracal_GoCaracal_Lightweight_RAT) for the lightweight GoCaracal implant.
Rules used to detect in-memory shellcode and credential theft during hunts.
Rules N4D_Linux_Loader_2026, N4D_Mesh_Agent_Unobfuscated and N4D_Linux_Delivery_Script for tracking the campaign
Rule-based malware detection; article provides a custom YARA rule 'Majinahanashi_Ransomware' to detect the ransomware samples
Pattern matching tool for analysts
Static analysis rule engine used by GuardDog to scan package source code for capabilities and threat indicators
Used by Open VSX in the background for many malware payload scans.
malware config/family detection and pattern matching
Malware/pattern scanning engine run by the XOR agent (--scan yara)
Rule-based scanning of files/directories, including per-file namespace compilation for rule directories
Signature generation area listed as an open contribution opportunity (not yet implemented)
New rules engine used by GuardDog 3.0 to run capability and threat-indicator rules efficiently; yara-python is an efficient Python library invoking native code through a CPython extension.
Signature-based pattern matching used as one of SkillSpector's detection methods; supports extra YARA rules directory via --yara-rules-dir
Referenced in context of size/hash-based detection rules tuned to v2 artifacts that would miss v3.
Used by the researchers to represent/demonstrate equivalent detection rules for the reverse-engineered PEHSTR/PEHSTR_EXT wildcard patterns.
signature rules that MorphKatz targets/prioritizes breaking via --target
signature/pattern matching rule engine used for static malware detection, example rule for PWS:Win32/Frethog.AB given
pattern matching rule format used to translate/represent Defender's wildcard sub-rule signatures as equivalent examples
Pattern-matching tool used (with rule sets) to attempt webshell detection
Signature-based detection; generated AsyncRAT sample was detected by various YARA signatures.
Writing detection rules/signatures for threat hunting, taught in Introduction to Threat Hunting
Pattern-matching engine used by malcontent with 14,500+ rules to detect malware-like capabilities
Pattern-matching rule engine used by Strelka's ScanYara scanner to identify suspicious or malicious file characteristics
Rule-based pattern matching engine used by YaraHunter to identify known malware signatures.
Matches tiered rules (T1/T2/T3) against composed 'scan text' rather than raw binaries; custom runner, no yara-python dependency
Pattern-matching/signature format for malware and file-system artifacts (architectural precedent for ATR)
Pattern-matching language and engine for describing byte patterns, strings, offsets, counts, and structural file properties, widely used for malware intelligence and detection engineering; used as the target rule language and oracle engine in this work
Pattern-matching language for malware/binary/text artifact detection (cited as architectural precedent for ATR)
All technologies in this workspace.