YARA and YARA-X
VirusTotal · YARA 4 / YARA-X 1 · 2026
Access and status
Cost
Free
Free to read or download at source. No account, no purchase.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
A pattern-matching language and scanner for identifying files by their content — strings, byte sequences, and structural conditions — used to label malware families and find known artefacts at scale. YARA-X is a ground-up rewrite in Rust from the same maintainers and is now the forward direction of the project; the original YARA 4.x line still receives releases and remains widely deployed.
Who it is for, and when
YARA is the common currency for sharing file-identification logic: a rule is short, readable, and portable, so an examiner can state exactly what pattern caused a file to be flagged. Practitioners use it to sweep a disk image or collection set for known tooling, to triage which of thousands of binaries deserve reverse engineering, and to pin a finding to a named rule in a report. YARA-X is largely rule-compatible and worth adopting for new work; check its documented differences before porting a large legacy ruleset.
What it does not cover
YARA matches patterns you already know about — it finds nothing novel, and a clean scan is not evidence of a clean system. It does not unpack, deobfuscate, or emulate, so packed samples defeat naive rules; it makes no behavioural judgement, so a match tells you a file resembles something, not what it did.
Go to the source
Open at virustotal.github.io (opens in a new tab)https://virustotal.github.io/yara-x/
Details
- Type
- Tool
- Written for
- Working examinerAdvancedWorking examiner, Advanced
- Publisher
- VirusTotal
- Version verified
- YARA 4 / YARA-X 1
- Year
- 2026
- Topics
- malware, threat-hunting, reverse-engineering, triage, open-source
- Checked at source
Related entries
CyberChef
FreeA browser-based tool published by GCHQ that chains together hundreds of data operations — encodings, ciphers, compression, hashing, timestamp conversion, parsing, and extraction — into a visible recipe. It runs entirely client-side and is actively released.
Ghidra
FreeAn open-source software reverse engineering framework released by the NSA, with a disassembler, a decompiler producing C-like output, scripting in Java and Python, and support for many processor architectures. The former ghidra-sre.org address now redirects to the GitHub project.
Two open-source Rust tools that apply Sigma and their own rules directly to Windows event log (EVTX) files and produce a prioritised, timeline-ordered set of hits. Hayabusa comes from Yamato Security; Chainsaw is published by WithSecure (the repository now lives under WithSecureOpenSource). Both are actively released.
Two closely related open-source reverse engineering frameworks. radare2 is the original Unix-style command-line toolkit for binary analysis, patching, and debugging; Rizin is a fork of radare2 that set out to stabilise the API and command set and ships the Cutter GUI. Both are actively developed and release regularly.
Velociraptor
FreeAn open-source endpoint visibility and DFIR platform built around VQL, a query language for collecting artefacts, monitoring events, and hunting across a fleet of agents. Development is sponsored by Rapid7, with the code still published under the Velocidex organisation.