thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

YARA

A pattern-matching tool and rule language for identifying and classifying malware based on textual or binary patterns.

Definition

YARA rules have meta, strings and condition sections, matching strings, hex patterns and regular expressions in files or memory. They are widely used by malware analysts, threat hunters, sandboxes and EDR tools to detect families and variants.

Example

rule Emotet_Doc { strings: $a = "AutoOpen" $b = { 4D 5A 90 00 } condition: all of them }

Exam tip

YARA matches files/memory; Sigma matches logs; Snort/Suricata match network traffic.

Related terms