YARA Style Guide: Comprehensive Best Practices for Naming, Structuring and Maintaining Detection Rules
The article presents a detailed translation and adaptation of Florian Roth's YARA Style Guide, aimed at bringing consistency to large collections of YARA rules used by security teams. It explains how to construct informative rule names that include threat category, context, operating system, architecture, technology, packers and creation date, using prefixes such as MAL, HKTL, WEBSHELL, EXPL, VULN, SUSP and PUA. The guide recommends specific metadata fields including description, author, date, reference, score and hash, along with a three-tier string categorization system using $x*, $s* and $a* prefixes for high-specificity, group and preliminary strings. It also covers false-positive filters marked with $fp*, proper indentation, readable hex and string formatting, and a recommended order of conditions that begins with header checks and ends with false-positive filters. The publication highlights the benefits of this structured approach for long-term maintainability and faster triage during mass detections. Additional references point to the separate YARA-Performance-Guidelines project for deeper optimization techniques.
Habr•Malware & Botnets
