yara-rule-authoring
trailofbits4.7k installs
Write malware rules with fewer false alarms.
What it does
Guides creation and review of malware detection rules that reduce false positives and avoid slow scanning patterns.
When to use it
Use when writing, reviewing, optimizing, or migrating YARA rules, or investigating false positives.
How to use it
It changes how the agent writes, reviews, and validates malware detection rules using malware samples and clean files.
What you provide
- Your files
Latest review
What you need · 5
Requires the YARA-X CLI to validate, format, inspect, and scan rules and samples.
The bundled analysis scripts require Python 3.11 or later.
Uses uv to run the bundled linter and atom analyzer before reviewing a rule.
Access · 1
This skill
yara-x
Execute
Installs YARA-X