yara (1)

yara [OPTION]... [RULEFILE]... FILE | PID

Yara scans the given FILE or the process indentified by PID looking if it matches the patterns and rules provided in a special purpose-language. The rules are read from RULEFILEs or standard input.

The options to yara(1) are:

-t tag

Print rules tagged as tag and ignore the rest. This option can be used multiple times.

-i identifier

Print rules named identifier and ignore the rest. This option can be used multiple times.

-n

Print rules that doesn't apply (negate)

-g

Print the tags associated to the rule.

-m

Print metadata associated to the rule.

-s

Print strings found in the file.

-p number

Use the specified number of threads to scan a directory.

-l number

Abort scanning after a number of rules matched.

-a seconds

Abort scanning after a number of seconds has elapsed.

-d identifier=value

Define an external variable. This option can be used multiple times.

-x module=file

Pass file's content as extra data to module. This option can be used multiple times.

-r

Scan files in directories recursively.

-f

Speeds up scanning by searching only for the first occurrence of each pattern.

-w

Disable warnings.

-v

Show version information.

$ yara /foo/bar/rules1 /foo/bar/rules2 .

Apply rules on /foo/bar/rules1 and /foo/bar/rules2 to all files on current directory. Subdirectories are not scanned.

$ yara -t Packer -t Compiler /foo/bar/rules bazfile

Apply rules on /foo/bar/rules to bazfile. Only reports rules tagged as Packer or Compiler.

$ cat /foo/bar/rules1 | yara -r /foo

Scan all files in the /foo directory and its subdirectories. Rules are read from standard input.

$ yara -d mybool=true -d myint=5 -d mystring="my string" /foo/bar/rules bazfile

Defines three external variables mybool myint and mystring.

$ yara -x cuckoo=cuckoo_json_report /foo/bar/rules bazfile

Apply rules on /foo/bar/rules to bazfile while passing the content of cuckoo_json_report to the cuckoo module.

Victor M. Alvarez <[email protected]>;<[email protected]>