YARA-X Rule Authoring

Write detection rules that catch malware without drowning in false positives. Based on Trail of Bits methodology.

Core Principles

1. 1. Strings must generate good atoms — YARA extracts 4-byte subsequences for fast matching. Strings with repeated bytes, common sequences, or under 4 bytes force slow bytecode scans.
2. Target specific families, not categories — "Detects ransomware" is useless. "Detects LockBit 3.0 config extraction routine" is useful.
3. Test against goodware — Validate against clean file sets before deployment.
4. Short-circuit with cheap checks first — filesize < 10MB and uint16(0) == 0x5A4D before expensive string searches.
5. Metadata is documentation — Future you needs to know what this catches and why.

YARA-X Basics

YARA-X is the Rust successor to legacy YARA: 5-10x faster, better errors, built-in formatter, stricter validation, new modules (crx, dex).

Install: brew install yara-x / cargo install yara-x
Commands: yr scan, yr check, yr fmt, INLINECODE6

Rule Template

CODEBLOCK0

Naming Convention

INLINECODE7 — examples:

• - INLINECODE8
• INLINECODE9
• INLINECODE10

String Selection

Good strings (unique, specific):

• - Mutex names, PDB paths, C2 URLs
• Unique byte sequences from disassembly
• Custom encryption constants
• Uncommon API call sequences

Bad strings (too common, high FP):

• - http://, https://, common API names alone
• Single common words, short strings (<4 bytes)
• Strings found in Windows system files

Condition Patterns

CODEBLOCK1

Common magic bytes:

Performance Rules

1. 1. Put filesize and magic byte checks FIRST in condition
2. Never use unbounded regex like INLINECODE19
3. Avoid for all with complex conditions on large files
4. Use ascii or wide, not both unless needed
5. Hex strings with specific bytes > wildcards > regex
6. Use at for fixed offsets instead of scanning entire file

Testing

CODEBLOCK2

False Positive Reduction

• - Add filesize constraints (malware has typical size ranges)
• Require multiple string matches (2 of ($str*) not any of)
• Exclude known good paths/publishers via not conditions
• Score-based approach: assign confidence scores in metadata, triage by threshold
• Test against goodware corpus before deployment

Reference

Full methodology, module docs (pe, elf, crx, dex), and migration guide from legacy YARA:
https://github.com/trailofbits/skills/tree/main/plugins/yara-authoring