Guides the creation of high-performance, precision YARA-X rules for malware detection and security auditing.
This skill provides comprehensive guidance for authoring, reviewing, and optimizing YARA-X detection rules, the Rust-based successor to legacy YARA. It helps security researchers and threat hunters create signatures that minimize false positives through rigorous string selection, performance short-circuiting, and platform-specific logic for environments ranging from Windows PE to Chrome extensions and Android DEX files. It includes detailed decision trees for string quality, debugging workflows for false positives, and best practices for migrating legacy signatures to the high-performance YARA-X engine.
Key Features
01Migration guidance from legacy YARA to the Rust-based YARA-X engine
02False positive reduction strategies using goodware testing and metadata documentation
03Optimized YARA-X rule generation with high-performance string atoms
04Specialized modules for analyzing Chrome extensions (crx) and Android apps (dex)
05Cross-platform detection patterns for Windows, macOS, Android, and JavaScript
062,924 GitHub stars
Use Cases
01Optimizing slow-running legacy YARA rules for high-speed scanning environments
02Converting threat intelligence and IOCs into production-ready detection signatures
03Authoring specific rules for macOS malware, malicious npm packages, or obfuscated JavaScript
