Installing YARA is pretty easy, for the most part. Below is the recommended approach for installing YARA and some additional tools that will help you do analysis and write rules throughout the course.


Download or Install YARA
- Windows: Download the latest pre-compiled binaries: https://github.com/VirusTotal/yara/releases
- Mac: Use Homebrew brew install yara

Recommended Tools Used Throughout the Course
- Visual Studio Code: useful text editor for composing YARA rules, supports syntax highlighting plugins
https://code.visualstudio.com/download
- 010 Editor: useful hex editor for viewing files and file strings
https://www.sweetscape.com/download/010editor/

strings
- Windows: strings.exe from sysinternals
- MacOS: strings might already be installed, you should check! Otherwise you can get strings as part of other packages such as Xcode Command Line Tools
- Mandiant’s FLOSS: tool for viewing strings and stack strings
https://github.com/mandiant/flare-floss/releases
- CyberChef: CyberChef can dump file strings, and it can also help with validating YARA syntax and YARA rule matching on input text or file content. Have this bookmarked and at the ready for your YARA journey:
https://gchq.github.io/CyberChef/

Complete Step