YARA Style Guide: Comprehensive Best Practices for Naming, Structuring and Maintaining Detection Rules
Florian Roth’s YARA Style Guide has been translated and adapted by security specialist Maxim Motikov of the Russian company Garda to help teams maintain large, consistent collections of detection rules. The guide addresses the common problem that YARA lacks a strict naming or formatting standard, causing rulebases to become disorganized over time.
Rule Naming Conventions
Rule names should combine threat category, context, target platform and creation date so that analysts can understand the purpose of a rule without opening the file. Recommended category prefixes include MAL for malware, HKTL for hacktools, WEBSHELL, EXPL for exploits, VULN for vulnerabilities, SUSP for suspicious patterns and PUA for potentially unwanted applications.
Context tags such as APT, CRIME, RANSOM and ANOMALY can be added, followed by malware type indicators like RAT, Implant, Stealer, Loader or Crypter. Platform and technology suffixes cover operating systems (WIN, LNX, MacOS), architectures (X64, X86, ARM) and file formats or languages (PE, ELF, PS1, VBS, JS, NET, Go, Rust, PHP and others).
Packers such as UPX, Themida and NSIS should be noted when relevant, and specific threat actor or family names (Lazarus, CozyBear, CobaltStrike, PlugX, QakBot) are written in full. Unique suffixes such as May23 or _1 help prevent naming collisions.
Rule Structure and Metadata
Every rule follows a consistent layout with meta, strings and condition sections. Mandatory metadata fields are description (starting with “Detects …”), author, reference and date in YYYY-MM-DD format. Optional but recommended fields include score (0–100), hash (preferably SHA256), modified date and license.
The score helps prioritize alerts: values above 85 indicate high-confidence detections, while lower scores flag generic or low-severity indicators. Additional tags can be stored in a dedicated meta field when they are not central enough for the rule name.
String Organization and Readability
Strings are categorized into three groups: high-specificity strings prefixed with $x*, group strings prefixed with $s* and preliminary filter strings prefixed with $a*. False-positive indicators receive the $fp* prefix so that matches on legitimate patterns can suppress alerts.
Hexadecimal byte sequences should be accompanied by ASCII comments when possible, and long values may be split into 16-byte segments. Simple text strings must never be written as hex unless they contain control characters.
Condition Formatting
Conditions should follow a logical order: header checks, file-size limitations, other constraints, string combinations and finally false-positive filters. Each “and” clause is placed on a new line, and “or” groups are indented for clarity.
By adopting these conventions, teams can create self-documenting rules that remain understandable months or years after creation and reduce the time required to triage large numbers of alerts.
Related articles
Callfuscated: Reverse Engineering a Stack-Based VM Protected by MBA, Opaque Predicates and Call-Based Jumps
A detailed technical write-up examines the HackTheBox challenge Callfuscated, which combines virtualization, mixed Boolean-arithmetic expressions, opaque predicates and junk instructions. The author first converts call-pop sequences into direct jumps by proving that register r8 is never read, then removes the resulting NOPs to obtain clean code. The resulting binary reveals a classic stack-based virtual machine whose handlers invoke heavily obfuscated functions. Triton is used to lift these functions into AST form, after which the CoBRA solver simplifies the MBA expressions into the original operations: addition, subtraction, multiplication, XOR, OR and AND. With semantics recovered, the author captures the bytecode at runtime, writes a C translator that emits readable operations, compiles the output and obtains a clean decompiled routine that checks the flag.
Backblaze Responds in Minutes While reg.ru Delays Action on Banking Trojan Infrastructure
A detailed reverse-engineering report reveals a sophisticated Android banking Trojan distributed via Telegram spam that disables antivirus apps, intercepts SMS one-time codes, and exfiltrates banking credentials. The malware uses AES-encrypted assets, a custom binary protocol over sockets, and multiple modules for screen streaming, keylogging, microphone access, and remote control. Infrastructure analysis traced the payload to an S3-compatible bucket on Backblaze, four command-and-control domains, and a VPS, with the domains registered through reg.ru. Notifications sent to Backblaze resulted in account termination within 11 minutes, while reg.ru responded only after a week with a statement refusing action without a court order. The same signing certificate appears across multiple variants, allowing rapid infrastructure rotation that keeps the campaign active despite takedown attempts. Kaspersky and CERT teams were also notified but produced no visible results within the observed period.
SLEEPWALKER Backdoor Activates on Windows via Single Custom Encrypted Packet
SLEEPWALKER is a passive Windows backdoor that stays dormant in memory until it receives one specially crafted encrypted network packet. Upon activation the implant decrypts and executes custom bytecode written in a proprietary 23-instruction language, eliminating traditional beaconing and reducing network indicators. The malware is delivered as a 64-bit DLL that impersonates dpapi.dll and is loaded via DLL side-loading into ERAAgent.exe, the executable of the ESET Management Agent used in ESET PROTECT deployments. It inspects raw traffic in promiscuous mode, supports multiple transport protocols including TCP, UDP, ICMP, SMB named pipes and VMware VMCI, and can weaken security by modifying registry values such as EveryoneIncludesAnonymous and NullSessionPipes. Configuration is protected with AES-256-CCM and the sample contains no confirmed victims or attributed infrastructure. Researchers have released YARA rules and read-only scanning utilities to detect the implant and its artifacts.
SLEEPWALKER Backdoor Stays Dormant Until Triggered by Single Custom Network Packet
SLEEPWALKER is a stealthy Windows backdoor that remains inactive until it receives one specially crafted encrypted network packet. The implant then decrypts and executes custom bytecode from a proprietary 23-instruction language, enabling chained tasks, data movement, and in-memory code execution without prior outbound communication. The 64-bit DLL masquerades as dpapi.dll and is designed for DLL side-loading into ERAAgent.exe, the executable of the ESET Management Agent used in ESET PROTECT deployments. It inspects raw network traffic in promiscuous mode, supports multiple transport protocols including TCP, UDP, ICMP, SMB named pipes, and VMware VMCI, and can weaken security by modifying registry values such as EveryoneIncludesAnonymous. No confirmed victims or attribution have been identified, and the analysis is based on a single sample. Researchers recommend auditing endpoints for unexpected dpapi.dll files alongside ERAAgent.exe and reviewing related registry settings.