YARA Style Guide: Comprehensive Best Practices for Naming, Structuring and Maintaining Detection Rules
Florian Roth’s YARA Style Guide has been translated and adapted by security specialist Maxim Motikov of the Russian company Garda to help teams maintain large, consistent collections of detection rules. The guide addresses the common problem that YARA lacks a strict naming or formatting standard, causing rulebases to become disorganized over time.
Rule Naming Conventions
Rule names should combine threat category, context, target platform and creation date so that analysts can understand the purpose of a rule without opening the file. Recommended category prefixes include MAL for malware, HKTL for hacktools, WEBSHELL, EXPL for exploits, VULN for vulnerabilities, SUSP for suspicious patterns and PUA for potentially unwanted applications.
Context tags such as APT, CRIME, RANSOM and ANOMALY can be added, followed by malware type indicators like RAT, Implant, Stealer, Loader or Crypter. Platform and technology suffixes cover operating systems (WIN, LNX, MacOS), architectures (X64, X86, ARM) and file formats or languages (PE, ELF, PS1, VBS, JS, NET, Go, Rust, PHP and others).
Packers such as UPX, Themida and NSIS should be noted when relevant, and specific threat actor or family names (Lazarus, CozyBear, CobaltStrike, PlugX, QakBot) are written in full. Unique suffixes such as May23 or _1 help prevent naming collisions.
Rule Structure and Metadata
Every rule follows a consistent layout with meta, strings and condition sections. Mandatory metadata fields are description (starting with “Detects …”), author, reference and date in YYYY-MM-DD format. Optional but recommended fields include score (0–100), hash (preferably SHA256), modified date and license.
The score helps prioritize alerts: values above 85 indicate high-confidence detections, while lower scores flag generic or low-severity indicators. Additional tags can be stored in a dedicated meta field when they are not central enough for the rule name.
String Organization and Readability
Strings are categorized into three groups: high-specificity strings prefixed with $x*, group strings prefixed with $s* and preliminary filter strings prefixed with $a*. False-positive indicators receive the $fp* prefix so that matches on legitimate patterns can suppress alerts.
Hexadecimal byte sequences should be accompanied by ASCII comments when possible, and long values may be split into 16-byte segments. Simple text strings must never be written as hex unless they contain control characters.
Condition Formatting
Conditions should follow a logical order: header checks, file-size limitations, other constraints, string combinations and finally false-positive filters. Each “and” clause is placed on a new line, and “or” groups are indented for clarity.
By adopting these conventions, teams can create self-documenting rules that remain understandable months or years after creation and reduce the time required to triage large numbers of alerts.
Related articles
187,064 Instructions for One Flag: Reverse Engineering HTB Callfuscated Insane Challenge
A detailed technical breakdown of the HackTheBox Callfuscated reversing challenge reveals an extremely heavy obfuscation scheme built around a custom virtual machine, mixed Boolean-arithmetic transformations, opaque predicates, and call-based junk code. The binary implements a password checker that executes 187,064 instructions even on a short input because every real operation is wrapped inside thousands of call/pop gadgets. The author bypassed static analysis by building a ptrace-based tracer, dumping the 586-cell VM program array, and writing a Python emulator that faithfully replays the recorded execution trace. After fixing several edge cases involving rand() return addresses and operand-size detection, the emulator reproduced the exact register state of the original binary. Dynamic analysis exposed that the VM performs simple big-endian word construction followed by XOR operations with eight constant pairs, allowing the flag to be recovered directly without further symbolic execution.
HollowGraph Malware Abuses Microsoft 365 Calendars to Conceal Stolen Files and C2 Traffic
A newly discovered espionage malware called HollowGraph turns compromised Microsoft 365 calendars into hidden channels for receiving commands and exfiltrating stolen data. The implant schedules events for 13 May 2050, a distant future date chosen to reduce the likelihood of discovery by account owners. Developed as a Windows DLL, HollowGraph leverages the Microsoft Graph API to blend its traffic with legitimate corporate service activity, eliminating the need to contact attacker-controlled servers directly. It supports two primary commands: “get” to retrieve instructions attached to operator-created appointments and “send” to encrypt collected data with RSA and AES-256-GCM before uploading it as calendar attachments. Separate encryption keys are used for inbound commands and outbound data, while stolen files are written to a disguised logAzure.txt file. Researchers have identified at least 12 compromised systems, three of which remained active, with operations observed between 3 June and 9 July 2026 and primarily targeting Israeli entities.
ClickLock Stealer Locks macOS Until Victims Enter Real Passwords and Exfiltrates Browser, Crypto and Keychain Data
Researchers at Group-IB have discovered a new macOS infostealer called ClickLock that blocks normal computer operation until the user supplies valid account credentials. The campaign, active since May 2026, has already affected at least 100 victims across 33 countries. Infection begins with a fake Cloudflare verification page that tricks users into pasting a command into Terminal, after which the malware silently downloads four modules from compromised WordPress sites. A convincing macOS password prompt then appears; ClickLock validates the entered password locally and only forwards working credentials to the operators. Two persistent LaunchAgent modules repeatedly close all visible applications and force Keychain authorization, while a separate process disables Notification Center for several hours. The malware harvests data from eight browsers, 31 crypto-wallet extensions, seven password managers, eight desktop wallets, Keychain items, command history, FTP credentials and six blockchain addresses before exfiltrating everything via Telegram bots and hijacked domains, leaving behind a disguised GSocket backdoor.
New Russian Translations of Leading Cybersecurity Books on Ethical Hacking, Reverse Engineering, Malware Analysis, and Privacy Released
A popular Russian library project has published fresh translations of more than a dozen top-tier English-language books covering ethical web hacking, bug bounty hunting, network protocol attacks, binary reverse engineering, malware analysis, fuzzing, and privacy protection. The updates continue the long-running “Materials on Hacking in Russian” series, with all books made freely available through the Hackbooks platform. Titles include Web Hacking 101, Real-World Bug Hunting, the official Nmap guide, Attacking Network Protocols, a comprehensive beginner’s reverse engineering textbook, and specialized works on binary format analysis, obfuscation techniques, Windows security internals, Practical Malware Analysis, Evasive Malware, and The Fuzzing Book. Additional volumes address the history of state surveillance, Crypto Wars, and the societal implications of mass data collection. Each book entry features detailed descriptions, practical examples, and direct links to the corresponding Hackbooks cards, enabling Russian-speaking researchers and students to study advanced information security topics without language barriers.