YARA Rules

YARA is a tool developed at VirusTotal, primarily aimed at helping malware researchers to identify and classify malware samples. It matches based on rules specified by the user containing textual or binary patterns and a boolean expression. For help on writing rules, see the YARA documentation.. YARA Rules lives in the Others category of the fx menu. See YARA for format details.

Parameters

Parameter	Type	Required	Default	Description
Input	string	yes	—	Value to transform. Previous step output or a literal.
Rules	string	no	—	Argument value for this operation.
Show strings	boolean	no	false	Disabled by default.
Show string lengths	boolean	no	false	Disabled by default.
Show metadata	boolean	no	false	Disabled by default.
Show counts	boolean	no	true	Enabled by default.

Input is the primary value (previous step output or a literal).

Returned value

Type	Description
string	Result of the YARA Rules transformation.

Limitations

• This operation treats Input as raw bytes (binary-capable). Non-text payloads may display differently after decoding.

Example

Run YARA Rules

YARA is a tool developed at VirusTotal, primarily aimed at helping malware researchers to identify and classify malware samples. Adjust optional parameters when the defaults do not match your payload.

1. Set Input to the value to transform (previous step output or a literal).

2. Review Rules, Show strings, Show string lengths, Show metadata, Show counts and keep defaults unless your format requires otherwise.

3. Confirm Output value shows the transformed result.