# YARA Rules

YARA is a tool developed at VirusTotal, primarily aimed at helping malware researchers to identify and classify malware samples. It matches based on rules specified by the user containing textual or binary patterns and a boolean expression. For help on writing rules, see the [YARA documentation.](https://yara.readthedocs.io/en/latest/writingrules.html). YARA Rules lives in the **Others** category of the `fx` menu. See [YARA](https://yara.readthedocs.io/) for format details.

## Parameters

| Parameter           | Type    | Required | Default | Description                                            |
| ------------------- | ------- | -------- | ------- | ------------------------------------------------------ |
| Input               | string  | yes      | —       | Value to transform. Previous step output or a literal. |
| Rules               | string  | no       | —       | Argument value for this operation.                     |
| Show strings        | boolean | no       | `false` | Disabled by default.                                   |
| Show string lengths | boolean | no       | `false` | Disabled by default.                                   |
| Show metadata       | boolean | no       | `false` | Disabled by default.                                   |
| Show counts         | boolean | no       | `true`  | Enabled by default.                                    |

`Input` is the primary value (previous step output or a literal).

## Returned value

| Type     | Description                              |
| -------- | ---------------------------------------- |
| `string` | Result of the YARA Rules transformation. |

## Limitations

- This operation treats Input as raw bytes (binary-capable). Non-text payloads may display differently after decoding.

## Example

<details>
<summary>Run YARA Rules</summary>

YARA is a tool developed at VirusTotal, primarily aimed at helping malware researchers to identify and classify malware samples. Adjust optional parameters when the defaults do not match your payload.

1. Set **Input** to the value to transform (previous step output or a literal).

2. Review **Rules**, **Show strings**, **Show string lengths**, **Show metadata**, **Show counts** and keep defaults unless your format requires otherwise.

3. Confirm **Output value** shows the transformed result.

</details>