Write and test a YARA rule

A hash only matches one exact file; change a single byte and it's useless. YARA rules match on patterns instead — strings, byte sequences, structure — which is why threat intel platforms and antivirus engines alike use them to describe a whole malware family, not one sample.

WHY THIS LAB

Pattern-matching, not file-matching

Chapter 3 covers decoding and parsing data and files as core detection techniques. YARA is the standard way analysts turn “this is what the malware family looks like” into something a machine can check automatically, at scale, across a whole file share or EDR fleet. Writing one rule by hand is also the fastest way to actually understand what a detection signature is doing under the hood.

A YARA RULE HAS TWO PARTS

A strings block lists what to look for — text, hex bytes, or a regular expression. A condition says how many of them, and in what combination, counts as a match.

BEFORE YOU START

What you'll need

OPERATING SYSTEM

Windows 10 or 11, 64-bit.

PREREQUISITE

The Microsoft Visual C++ Redistributable (x86 and x64) — YARA's Windows build needs it.

EDITOR

Notepad is fine. Rules are plain text saved with a .yar extension.

TIME

20–30 minutes.

CyberCorps.uk · Lab 8 Page 1 of 2

INSTALL · WRITE A RULE · SOURCES CyberCorps.uk · LAB 8

PART 1 · INSTALL YARA

Get the scanner on your PATH

Download it. Go to github.com/VirusTotal/yara/releases, open the latest release, and download yara-<version>-win64.zip.
Extract it. Unzip to a permanent folder, e.g. C:\YARA.
Add it to PATH. Search “Environment Variables” in the Start menu → Edit the system environment variables → Environment Variables → select Path under System variables → Edit → New → add C:\YARA.
Verify it. Open a new Command Prompt (it must be new, to pick up the PATH change) and run:
```
yara64 --version
```

PART 2 · WRITE AND TEST A RULE

Match a pattern, not a file

Create the rule. Save this as C:\YARA\first_rule.yar:

rule Suspicious_PowerShell_Download
{
   strings:
      $a = "DownloadString" nocase
      $b = "IEX" nocase
      $c = "-EncodedCommand" nocase
   condition:
      2 of them
}

Create a test file. Save a text file, e.g. test.txt, containing a line like powershell -EncodedCommand ... IEX (New-Object Net.WebClient).DownloadString(...) — a made-up example is fine, it just needs the strings.
Run the scan:
```
yara64 first_rule.yar test.txt
```
If two or more of the three strings are present, YARA prints the rule name and the file it matched.
Scan a whole folder. Add -r to scan a directory recursively:
```
yara64 -r first_rule.yar C:\some\folder
```

LOOSE RULES GENERATE NOISE

A rule that matches on one generic string alone (like “http”) will fire constantly and get ignored. Real rules combine several specific indicators with a condition — the same signal-to-noise problem Chapter 3 raises for any detection tool.

Sources. VirusTotal, YARA releases, github.com/VirusTotal/yara/releases. YARA documentation, yara.readthedocs.io. Installation steps adapted from LetsDefend's Windows install walkthrough.

CyberCorps.uk · Lab 8 Page 2 of 2

Connect this lab to your learning

1.3 Investigation tools →