Special (Bonus) Modules

There are a handful of special modules in YARA that do not have much (if any documentation) and may not always come in the pre-compiled binaries. These are viewable in the YARA source code and may have to be included during compilation. Make sure to check up on documentation on how to compile YARA to see if these modules come with your YARA binary, or if you want to explore a custom-compilation.


dex - Android Dalvek executable format. This is not documented but available in the source code.
macho - This is for the Mach-O file format. There is no documentation for this, but it may be included in some precompiled binaries.
magic - This uses Unix file command, so doesn’t work on Windows.
cuckoo - In the Cuckoo sandbox platform, this module allows you to write YARA rules against external parameters passed in from the sandbox runs.

Remember that YARA is always evolving! The developer community continues to add features, introduce new modules, extend old modules, and improve documentation over time.


Extending YARA with Custom Modules

Many organizations who seek to integrate YARA into their custom technologies will develop a custom module to extend YARA’s functionality.


For example, a company that has an e-mail security sensor may write a custom module to pass in external variables from their email metadata so they can write rules that use both YARA’s native functionality and their own.


YARA provides a framework and instructions for how to write new modules, so as analysts identify new needs for writing YARA rules against particular file types, the development community may introduce new modules.


BitsofBinary created a custom module for LNK files so that analysts can write  YARA rules against specific LNK features such as the machine it was created on. This module has not (yet) been integrated into the main YARA release, but the rule below illustrates how the module opens up new possibilities for creative rule writing.


import "lnk"
rule example_use_of_lnk_module {
condition:
	lnk.is_lnk
	and lnk.tracker_data.machine_id == "facebook-pc"
	and lnk.link_info.local_base_path == "C:\\test\\a.txt"
}

YARA Module References

Compiling YARA with modules: https://yara.readthedocs.io/en/stable/gettingstarted.html#compiling-and-installing-yara
Modules: https://yara.readthedocs.io/en/stable/modules.html
Modules source code: https://github.com/VirusTotal/yara/tree/c506276eea6eabc6bf5af899b97d4f25d98326c8/libyara/modules

Custom Module References

Writing custom modules: https://yara.readthedocs.io/en/stable/writingmodules.html
Proposed LNK module: https://github.com/VirusTotal/yara/pull/1732

