Getting Started with YARA

Download the latest precompiled YARA binaries
https://github.com/VirusTotal/yara/releases
Read the documents about writing YARA rules
https://yara.readthedocs.io/en/stable/writingrules.html
Massive collection of links to YARA things
https://github.com/InQuest/awesome-yara
#100DaysofYARA, efforts for people learning and sharing about YARA
#100DaysofYARA on Infosec.exchange
#100DaysofYARA on Twitter
#100DaysofYARA on Github

A Selection of Good YARA Reading and Resources

What is YARA and Why it Matters (Stairwell)
Quick n Dirty YARA Testing on Malware Corpora (Stairwell)
Hunting with YARA and Weak Signals (Stairwell)
University of Cincinnati Malware Analysis Class (CS[567]038)
APNIC Series on YARA Content Ordering by Vitaly Kamluk
Three Body Problem
Distance Between Elements
Dealing With Wildcard Hex Patterns
Red Pill Approach
100DaysofYARA blog by BitsofBinary (github)

YARA Related Projects and Tooling

Cerebro (github), generates YARA friendly string mutations for rule writing
RonnieColemanYARAParser (github), uses YARA to perform bulk analysis of PE files
yar2d2 (github), identify shared code between files and translate into YARA rules:
Halogen (github), automatically create YARA rules from documents
apooxml (github), generate YARA rules for OOXML docs based on ZIP header metadata
yara-signator (github), automatically generate YARA rules from samples
Read the paper, too! (pdf)
yaraGen (github), a generator for YARA rules
KLara (github), distributed YARA scanning and scan management system
yaya (github), automatically curate open source yara rules and run scans
CCCS YARA Rule Specification
Sophos’ Security ML models encoded as Yara rules (github)
Avast’s interactive YARA rule debugger YARI (github)
For more extensive list of YARA related tools, refer to the huge list
https://github.com/InQuest/awesome-yara#tools

Malware Corpora

https://www.vx-underground.org/malware.html
https://malshare.com/
https://bazaar.abuse.ch/

Other Resources and Reading

https://www.garykessler.net/library/file_sigs.html (Useful for file magic)
https://zeltser.com/free-malware-analysis-windows-vm/ (Setting up an analysis VM)
https://www.sentinelone.com/labs/building-a-custom-malware-analysis-lab-environment/ (Building analysis VM)
https://developer.microsoft.com/en-us/windows/downloads/virtual-machines/ (Download free Windows 11 VMs)

Other Tools Used In the Course

Visual Studio Code: https://code.visualstudio.com/download
010 Editor: https://www.sweetscape.com/download/010editor/
strings
Windows: strings.exe from sysinternals
MacOS: strings Xcode Command Line Tools
Mandiant’s FLOSS: https://github.com/mandiant/flare-floss/releases
