Home · Browse · YARA

YARA

1 program Added 2026-02-08T15:53:07Z Agent: claude-codeModel: sonnetWebSearch: disabled Evidence Report issue View issues

Aliases: Yara

Provenance: commit 81b889e4df · authored 2026-02-08T16:53:49+01:00 · agent claude-code · model sonnet

Sources mentioning this language

5 sources · pl_id: pl/yara

LLM (this repo) · 1 Pldb Linguist Pygments Hyperpolyglot

Extensions claimed by this language

3 claims. Each row is one upstream assertion with its strength. SWH column shows file occurrences with that extension across the entire archive.

Extension	Source	Strength	SWH
`.yar`	linguist	primary	58.3K files
`.yar`	pygments	primary	58.3K files
`.yara`	linguist	secondary	162.8K files

Related languages

Klara (0.27)Yona (0.27)Yatima (0.25)Gura (0.18)Mira (0.18)

LLM-contributed programs

Example Malware Detection Rule

Origin · Download · manifest.json · Report

Provenance: commit 81b889e4df · authored 2026-02-08T16:53:49+01:00 · agent claude-code · model sonnet · WebSearch disabled

code.yar · added: 2026-02-08T15:53:07Z

rule ExampleMalware
{
    meta:
        description = "Detects example malware pattern"
        author = "Security Researcher"
        date = "2024-01-01"

    strings:
        $mz = "MZ"
        $string1 = "malicious" nocase
        $string2 = "backdoor" nocase
        $hex_string = { 6A 40 68 00 30 00 00 }

    condition:
        $mz at 0 and (
            $string1 or $string2 or $hex_string
        ) and filesize < 5MB
}

Real programs from Software Heritage

1 sample mined from derived_datasets/<date>/contents/*.parquet, byte-verified against the SWH archive. Citation-grade qualified SWHIDs preserved.

Proton.yar · 801 B · ext .yar · seen 17× in SWH

via unique-primary

swh:1:cnt:afdcfbc6432b04570faf777c62270a41e93ef049;origin=https://github.com/rivitna/Malware;anchor=swh:1:rev:eda0c3083fd9575677fd0db762108f0bd2e05b9a;path=/Proton/Proton.yar

Open in SWH · Raw bytes (SWH) · GitHub raw

Show source

/*
Proton ransomware
*/


rule Proton
{
    meta:
        author = "rivitna"
        family = "ransomware.proton"
        description = "Proton ransomware Windows payload"
        severity = 10
        score = 100

    strings:
        $s0 = ".[<EMAIL>]<EXTENSION>\x00" wide
        $s1 = "\x00<BACKUP_EMAIL>\x00" wide
        $h0 = "4B991369-7C7C-47AA-A81E-EF6ED1F5E24C" ascii
        $h1 = { 81 F? 00 00 20 03 ( 73 | 7D ) [2-5] 10 00 00 00 [2-18]
                81 F? 00 00 40 06 ( 73 | 7D ) [2-5] 20 00 00 00 [2-18]
                81 F? 00 00 40 1F ( 73 | 7D ) [2-5] 40 00 00 00 }

    condition:
        ((uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550)) and
        (
            ((1 of ($h*)) and (1 of ($s*))) or
            (3 of them)
        )
}

Contribute — propose a file extension

Tell us where to find evidence about YARA (mapped to pl/yara). A reference URL is required; at least one of extension or program code must be provided too. A maintainer reviews each submission via a draft PR before anything lands.

File extension (optional) — e.g. .oak. Some PLs (e.g. esolangs) have no convention; leave empty if so. Friendly name (optional)

Reference URL * — public URL where the extension is used (GitHub file, GitLab, spec page, …) Notes (optional) — 1–3 sentences if context helps the maintainer

Optional: attach a program from that URL

If the reference URL points at a single source file you'd like to add as an example program, paste it below. The workflow will write it under languages/YARA/programs/<sha>/. Keep under ~200 lines.

Title (optional) — e.g. "Factorial", "Quicksort" License guess (optional) — MIT, GPL-2.0, …

Code (optional) — paste verbatim bytes from the reference URL

(or open the pre-filled issue directly)