[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6FJPFMAS9G590TH9J856YMB":3,"skill-same:01M6FJPFMAS9G590TH9J856YMB":49},{"skillNo":4,"name":5,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":22,"linkOnly":23,"markdownContent":24,"markdownBody":24,"frontMatter":25,"refName":26,"commitSha":27,"skillDirectory":28,"forksCount":29,"repositoryHtmlUrl":30,"repositoryHomepageUrl":31,"ownerHtmlUrl":32,"ownerBlogUrl":6,"ownerDescription":33,"updatedAt":34,"install":35,"resources":48},"01M6FJPFMAS9G590TH9J856YMB","yara-rule-authoring",null,"ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",67,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Ftrailofbits\u002Fskills\u002Fyara-rule-authoring\u002FSKILL.md",[],[18,19,20,21],"yara","authoring","yara rule authoring","rule","2026-11-10 10:12:30",false,"# YARA-X Rule Authoring\n\nWrite detection rules that catch malware without drowning in false positives.\n\n> **This skill targets YARA-X**, the Rust-based successor to legacy YARA. YARA-X powers VirusTotal's production systems and is the recommended implementation. See [Migrating from Legacy YARA](#migrating-from-legacy-yara) if you have existing rules.\n\n## Core Principles\n\n1. **Strings must generate good atoms** — YARA extracts 4-byte subsequences for fast matching. Strings with repeated bytes, common sequences, or under 4 bytes force slow bytecode verification on too many files.\n\n2. **Target specific families, not categories** — \"Detects ransomware\" catches everything and nothing. \"Detects LockBit 3.0 configuration extraction routine\" catches what you want.\n\n3. **Test against goodware before deployment** — A rule that fires on Windows system files is useless. Validate against VirusTotal's goodware corpus or your own clean file set.\n\n4. **Short-circuit with cheap checks first** — Put `filesize \u003C 10MB and uint16(0) == 0x5A4D` before expensive string searches or module calls.\n\n5. **Metadata is documentation** — Future you (and your team) need to know what this catches, why, and where the sample came from.\n\n## When to Use\n\n- Writing new YARA-X rules for malware detection\n- Reviewing existing rules for quality or performance issues\n- Optimizing slow-running rulesets\n- Converting IOCs or threat intel into detection signatures\n- Debugging false positive issues\n- Preparing rules for production deployment\n- Migrating legacy YARA rules to YARA-X\n- Analyzing Chrome extensions (crx module)\n- Analyzing Android apps (dex module)\n\n## When NOT to Use\n\n- Static analysis requiring disassembly → use Ghidra\u002FIDA skills\n- Dynamic malware analysis → use sandbox analysis skills\n- Network-based detection → use Suricata\u002FSnort skills\n- Memory forensics with Volatility → use memory forensics skills\n- Simple hash-based detection → just use hash lists\n\n## YARA-X Overview\n\nYARA-X is the Rust-based successor to legacy YARA: 5-10x faster regex, better errors, built-in formatter, stricter validation, new modules (crx, dex), 99% rule compatibility.\n\n**Install:** `brew install yara-x` (macOS) or `cargo install yara-x`\n\n**Essential commands:** `yr scan`, `yr check`, `yr fmt`, `yr dump`\n\n## Platform Considerations\n\nYARA works on any file type. Adapt patterns to your target:\n\n| Platform | Magic Bytes | Bad Strings | Good Strings |\n|----------|-------------|-------------|--------------|\n| **Windows PE** | `uint16(0) == 0x5A4D` | API names, Windows paths | Mutex names, PDB paths |\n| **macOS Mach-O** | `uint32(0) == 0xFEEDFACE` (32-bit), `0xFEEDFACF` (64-bit), `0xCAFEBABE` (universal) | Common Obj-C methods | Keylogger strings, persistence paths |\n| **JavaScript\u002FNode** | (none needed) | `require`, `fetch`, `axios` | Obfuscator signatures, eval+decode chains |\n| **npm\u002Fpip packages** | (none needed) | `postinstall`, `dependencies` | Suspicious package names, exfil URLs |\n| **Office docs** | `uint32(0) == 0x504B0304` | VBA keywords | Macro auto-exec, encoded payloads |\n| **VS Code extensions** | (none needed) | `vscode.workspace` | Uncommon activationEvents, hidden file access |\n| **Chrome extensions** | Use `crx` module | Common Chrome APIs | Permission abuse, manifest anomalies |\n| **Android apps** | Use `dex` module | Standard DEX structure | Obfuscated classes, suspicious permissions |\n\n### macOS Malware Detection\n\nNo dedicated Mach-O module exists yet. Use magic byte checks + string patterns:\n\n**Magic bytes:**\n```yara\n\u002F\u002F Mach-O 32-bit\nuint32(0) == 0xFEEDFACE\n\u002F\u002F Mach-O 64-bit\nuint32(0) == 0xFEEDFACF\n\u002F\u002F Universal binary (fat binary)\nuint32(0) == 0xCAFEBABE or uint32(0) == 0xBEBAFECA\n```\n\n**Good indicators for macOS malware:**\n- Keylogger artifacts: `CGEventTapCreate`, `kCGEventKeyDown`\n- SSH tunnel strings: `ssh -D`, `tunnel`, `socks`\n- Persistence paths: `~\u002FLibrary\u002FLaunchAgents`, `\u002FLibrary\u002FLaunchDaemons`\n- Credential theft: `security find-generic-password`, `keychain`\n\n**Example pattern from Airbnb BinaryAlert:**\n```yara\nrule SUSP_Mac_ProtonRAT\n{\n    strings:\n        \u002F\u002F Library indicators\n        $lib1 = \"SRWebSocket\" ascii\n        $lib2 = \"SocketRocket\" ascii\n\n        \u002F\u002F Behavioral indicators\n        $behav1 = \"SSH tunnel not launched\" ascii\n        $behav2 = \"Keylogger\" ascii\n\n    condition:\n        (uint32(0) == 0xFEEDFACF or uint32(0) == 0xCAFEBABE) and\n        any of ($lib*) and any of ($behav*)\n}\n```\n\n### JavaScript Detection Decision Tree\n\n```\nWriting a JavaScript rule?\n├─ npm package?\n│  ├─ Check package.json patterns\n│  ├─ Look for postinstall\u002Fpreinstall hooks\n│  └─ Target exfil patterns: fetch + env access + credential paths\n├─ Browser extension?\n│  ├─ Chrome: Use crx module\n│  └─ Others: Target manifest patterns, background script behaviors\n├─ Standalone JS file?\n│  ├─ Look for obfuscation markers: eval+atob, fromCharCode chains\n│  ├─ Target unique function\u002Fvariable names (often survive minification)\n│  └─ Check for packed\u002Fencoded payloads\n└─ Minified\u002Fwebpack bundle?\n   ├─ Target unique strings that survive bundling (URLs, magic values)\n   └─ Avoid function names (will be mangled)\n```\n\n**JavaScript-specific good strings:**\n- Ethereum function selectors: `{ 70 a0 82 31 }` (transfer)\n- Zero-width characters (steganography): `{ E2 80 8B E2 80 8C }`\n- Obfuscator signatures: `_0x`, `var _0x`\n- Specific C2 patterns: domain names, webhook URLs\n\n**JavaScript-specific bad strings:**\n- `require`, `fetch`, `axios` — too common\n- `Buffer`, `crypto` — legitimate uses everywhere\n- `process.env` alone — need specific env var names\n\n## Essential Toolkit\n\n| Tool | Purpose |\n|------|---------|\n| **yarGen** | Extract candidate strings: `yarGen.py -m samples\u002F --excludegood` → validate with `yr check` |\n| **FLOSS** | Extract obfuscated\u002Fstack strings: `floss sample.exe` (when yarGen fails) |\n| **yr CLI** | Validate: `yr check`, scan: `yr scan -s`, inspect: `yr dump -m pe` |\n| **signature-base** | Study quality examples |\n| **YARA-CI** | Goodware corpus testing before deployment |\n\nMaster these five. Don't get distracted by tool catalogs.\n\n## Rationalizations to Reject\n\nWhen you catch yourself thinking these, stop and reconsider.\n\n| Rationalization | Expert Response |\n|-----------------|-----------------|\n| \"This generic string is unique enough\" | Test against goodware first. Your intuition is wrong. |\n| \"yarGen gave me these strings\" | yarGen suggests, you validate. Check each one manually. |\n| \"It works on my 10 samples\" | 10 samples ≠ production. Use VirusTotal goodware corpus. |\n| \"One rule to catch all variants\" | Causes FP floods. Target specific families. |\n| \"I'll make it more specific if we get FPs\" | Write tight rules upfront. FPs burn trust. |\n| \"This hex pattern is unique\" | Unique in one sample ≠ unique across malware ecosystem. |\n| \"Performance doesn't matter\" | One slow rule slows entire ruleset. Optimize atoms. |\n| \"PEiD rules still work\" | Obsolete. 32-bit packers aren't relevant. |\n| \"I'll add more conditions later\" | Weak rules deployed = damage done. |\n| \"This is just for hunting\" | Hunting rules become detection rules. Same quality bar. |\n| \"The API name makes it malicious\" | Legitimate software uses same APIs. Need behavioral context. |\n| \"any of them is fine for these common strings\" | Common strings + any = FP flood. Use `any of` only for individually unique strings. |\n| \"This regex is specific enough\" | `\u002Ffetch.*token\u002F` matches all auth code. Add exfil destination requirement. |\n| \"The JavaScript looks clean\" | Attackers poison legitimate code with injects. Check for eval+decode chains. |\n| \"I'll use .* for flexibility\" | Unbounded regex = performance disaster + memory explosion. Use `.{0,30}`. |\n| \"I'll use --relaxed-re-syntax everywhere\" | Masks real bugs. Fix the regex instead of hiding problems. |\n\n## Decision Trees\n\n### Is This String Good Enough?\n\n```\nIs this string good enough?\n├─ Less than 4 bytes?\n│  └─ NO — find longer string\n├─ Contains repeated bytes (0000, 9090)?\n│  └─ NO — add surrounding context\n├─ Is an API name (VirtualAlloc, CreateRemoteThread)?\n│  └─ NO — use hex pattern of call site instead\n├─ Appears in Windows system files?\n│  └─ NO — too generic, find something unique\n├─ Is it a common path (C:\\Windows\\, cmd.exe)?\n│  └─ NO — find malware-specific paths\n├─ Unique to this malware family?\n│  └─ YES — use it\n└─ Appears in other malware too?\n   └─ MAYBE — combine with family-specific marker\n```\n\n### When to Use \"all of\" vs \"any of\"\n\n```\nShould I require all strings or allow any?\n├─ Strings are individually unique to malware?\n│  └─ any of them (each alone is suspicious)\n├─ Strings are common but combination is suspicious?\n│  └─ all of them (require the full pattern)\n├─ Strings have different confidence levels?\n│  └─ Group: all of ($core_*) and any of ($variant_*)\n└─ Seeing many false positives?\n   └─ Tighten: switch any → all, add more required strings\n```\n\n**Lesson from production:** Rules using `any of ($network_*)` where strings included \"fetch\", \"axios\", \"http\" matched virtually all web applications. Switching to require credential path AND network call AND exfil destination eliminated FPs.\n\n### When to Abandon a Rule Approach\n\nStop and pivot when:\n\n- **yarGen returns only API names and paths** → See [When Strings Fail, Pivot to Structure](#when-strings-fail-pivot-to-structure)\n\n- **Can't find 3 unique strings** → Probably packed. Target the unpacked version or detect the packer.\n\n- **Rule matches goodware files** → Strings aren't unique enough. 1-2 matches = investigate and tighten; 3-5 matches = find different indicators; 6+ matches = start over.\n\n- **Performance is terrible even after optimization** → Architecture problem. Split into multiple focused rules or add strict pre-filters.\n\n- **Description is hard to write** → The rule is too vague. If you can't explain what it catches, it catches too much.\n\n### Debugging False Positives\n\n```\nFP Investigation Flow:\n│\n├─ 1. Which string matched?\n│     Run: yr scan -s rule.yar false_positive.exe\n│\n├─ 2. Is it in a legitimate library?\n│     └─ Add: not $fp_vendor_string exclusion\n│\n├─ 3. Is it a common development pattern?\n│     └─ Find more specific indicator, replace the string\n│\n├─ 4. Are multiple generic strings matching together?\n│     └─ Tighten to require all + add unique marker\n│\n└─ 5. Is the malware using common techniques?\n      └─ Target malware-specific implementation details, not the technique\n```\n\n### Hex vs Text vs Regex\n\n```\nWhat string type should I use?\n│\n├─ Exact ASCII\u002FUnicode text?\n│  └─ TEXT: $s = \"MutexName\" ascii wide\n│\n├─ Specific byte sequence?\n│  └─ HEX: $h = { 4D 5A 90 00 }\n│\n├─ Byte sequence with variation?\n│  └─ HEX with wildcards: { 4D 5A ?? ?? 50 45 }\n│\n├─ Pattern with structure (URLs, paths)?\n│  └─ BOUNDED REGEX: \u002Fhttps:\\\u002F\\\u002F[a-z]{5,20}\\.onion\u002F\n│\n└─ Unknown encoding (XOR, base64)?\n   └─ TEXT with modifier: $s = \"config\" xor(0x00-0xFF)\n```\n\n### Is the Sample Packed? (Check First)\n\nBefore writing any string-based rule:\n\n```\nIs the sample packed?\n├─ Entropy > 7.0?\n│  └─ Likely packed — find unpacked layer first\n├─ Few\u002Fno readable strings?\n│  └─ Likely packed — use entropy, PE structure, or packer signatures\n├─ UPX\u002FMPRESS\u002Fcustom packer detected?\n│  └─ Target the unpacked payload OR detect the packer itself\n└─ Readable strings available?\n   └─ Proceed with string-based detection\n```\n\n**Expert guidance:** Don't write rules against packed layers. The packing changes; the payload doesn't.\n\n### When Strings Fail, Pivot to Structure\n\nIf yarGen returns only API names and generic paths:\n\n```\nString extraction failed — what now?\n├─ High entropy sections?\n│  └─ Use math.entropy() on specific sections\n├─ Unusual imports pattern?\n│  └─ Use pe.imphash() for import hash clustering\n├─ Consistent PE structure anomalies?\n│  └─ Target section names, sizes, characteristics\n├─ Metadata present?\n│  └─ Target version info, timestamps, resources\n└─ Nothing unique?\n   └─ This sample may not be detectable with YARA alone\n```\n\n**Expert guidance:** \"One can try to use other file properties, such as metadata, entropy, import hashes or other data which stays constant.\" — Kaspersky Applied YARA Training\n\n## Expert Heuristics\n\n**String selection:** Mutex names are gold; C2 paths silver; error messages bronze. Stack strings are almost always unique. If you need >6 strings, you're over-fitting.\n\n**Condition design:** Start with `filesize \u003C`, then magic bytes, then strings, then modules. If >5 lines, split into multiple rules.\n\n**Quality signals:** yarGen output needs 80% filtering. Rules matching \u003C50% of variants are too narrow; matching goodware are too broad.\n\n**Modifier discipline:**\n- **Never use `nocase` or `wide` speculatively** — only when you have confirmed evidence the case\u002Fencoding varies in samples\n- `nocase` doubles atom generation; `wide` doubles string matching — both have real costs\n- \"If you don't have a clear reason for using those modifiers, don't do it\" — Kaspersky Applied YARA\n\n**Regex anchoring:**\n- Regex without a 4+ byte literal substring **evaluates at every file offset** — catastrophic performance\n- Always anchor regex to a distinctive literal: `\u002Fmshta\\.exe http:\\\u002F\\\u002F...\u002F` not `\u002Fhttp:\\\u002F\\\u002F...\u002F`\n- If you can't anchor, consider hex pattern with wildcards instead\n\n**Loop discipline:**\n- Always bound loops with filesize: `filesize \u003C 100KB and for all i in (1..#a) : ...`\n- Unbounded `#a` can be thousands in large files — exponential slowdown\n\n**YARA-X tips:** `$_unused` to suppress warnings; `private $s` to hide from output; `yr check` + `yr fmt` before every commit.\n\n### When to Use Modules vs. Byte Checks\n\n```\nShould I use a module or raw bytes?\n├─ Need imphash\u002Frich header\u002Fauthenticode?\n│  └─ Use PE module — too complex to replicate\n├─ Just checking magic bytes or simple offsets?\n│  └─ Use uint16\u002Fuint32 — faster, no module overhead\n├─ Checking section names\u002Fsizes?\n│  └─ PE module is cleaner, but add magic bytes filter FIRST\n├─ Checking Chrome extension permissions?\n│  └─ Use crx module — string parsing is fragile\n└─ Checking LNK target paths?\n   └─ Use lnk module — LNK format is complex\n```\n\n**Expert guidance:** \"Avoid the magic module — use explicit hex checks instead\" — Neo23x0. Apply this principle: if you can do it with uint32(), don't load a module.\n\n## YARA-X New Features\n\nKey additions from recent releases:\n\n- **Private patterns** (v1.3.0+): `private $helper = \"pattern\"` — matches but hidden from output\n- **Warning suppression** (v1.4.0+): `\u002F\u002F suppress: slow_pattern` inline comments\n- **Numeric underscores** (v1.5.0+): `filesize \u003C 10_000_000` for readability\n- **Built-in formatter**: `yr fmt rules\u002F` to standardize formatting\n- **NDJSON output**: `yr scan --output-format ndjson` for tooling\n\n## YARA-X Tooling Workflow\n\nYARA-X provides diagnostic tools legacy YARA lacks:\n\n**Rule development cycle:**\n```bash\n# 1. Write initial rule\n# 2. Check syntax with detailed errors\nyr check rule.yar\n\n# 3. Format consistently\nyr fmt -w rule.yar\n\n# 4. Dump module output to inspect file structure (no dummy rule needed)\nyr dump -m pe sample.exe --output-format yaml\n\n# 5. Scan with timing info\ntime yr scan -s rule.yar corpus\u002F\n```\n\n**When to use `yr dump`:**\n- Investigating what PE\u002FELF\u002FMach-O fields are available\n- Debugging why module conditions aren't matching\n- Exploring new modules (crx, lnk, dotnet) before writing rules\n\n**YARA-X diagnostic advantage:** Error messages include precise source locations. If `yr check` points to line 15, the issue is actually on line 15 (unlike legacy YARA).\n\n## Chrome Extension Analysis (crx module)\n\nThe `crx` module enables detection of malicious Chrome extensions. Requires YARA-X v1.5.0+ (basic), v1.11.0+ for `permhash()`.\n\n**Key APIs:** `crx.is_crx`, `crx.permissions`, `crx.permhash()`\n\n**Red flags:** `nativeMessaging` + `downloads`, `debugger` permission, content scripts on `\u003Call_urls>`\n\n```yara\nimport \"crx\"\n\nrule SUSP_CRX_HighRiskPerms {\n    condition:\n        crx.is_crx and\n        for any perm in crx.permissions : (perm == \"debugger\")\n}\n```\n\nSee [crx-module.md](references\u002Fcrx-module.md) for complete API reference, permission risk assessment, and example rules.\n\n## Android DEX Analysis (dex module)\n\nThe `dex` module enables detection of Android malware. Requires YARA-X v1.11.0+. **Not compatible with legacy YARA's dex module** — API is completely different.\n\n**Key APIs:** `dex.is_dex`, `dex.contains_class()`, `dex.contains_method()`, `dex.contains_string()`\n\n**Red flags:** Single-letter class names (obfuscation), `DexClassLoader` reflection, encrypted assets\n\n```yara\nimport \"dex\"\n\nrule SUSP_DEX_DynamicLoading {\n    condition:\n        dex.is_dex and\n        dex.contains_class(\"Ldalvik\u002Fsystem\u002FDexClassLoader;\")\n}\n```\n\nSee [dex-module.md](references\u002Fdex-module.md) for complete API reference, obfuscation detection, and example rules.\n\n## Migrating from Legacy YARA\n\nYARA-X has 99% rule compatibility, but enforces stricter validation.\n\n**Quick migration:**\n```bash\nyr check --relaxed-re-syntax rules\u002F  # Identify issues\n# Fix each issue, then:\nyr check rules\u002F  # Verify without relaxed mode\n```\n\n**Common fixes:**\n| Issue | Legacy | YARA-X Fix |\n|-------|--------|------------|\n| Literal `{` in regex | `\u002F{\u002F` | `\u002F\\{\u002F` |\n| Invalid escapes | `\\R` silently literal | `\\\\R` or `R` |\n| Base64 strings | Any length | 3+ chars required |\n| Negative indexing | `@a[-1]` | `@a[#a - 1]` |\n| Duplicate modifiers | Allowed | Remove duplicates |\n\n> **Note:** Use `--relaxed-re-syntax` only as a diagnostic tool. Fix issues rather than relying on relaxed mode.\n\n## Quick Reference\n\n### Naming Convention\n\n```\n{CATEGORY}_{PLATFORM}_{FAMILY}_{VARIANT}_{DATE}\n```\n\n**Common prefixes:** `MAL_` (malware), `HKTL_` (hacking tool), `WEBSHELL_`, `EXPL_`, `SUSP_` (suspicious), `GEN_` (generic)\n\n**Platforms:** `Win_`, `Lnx_`, `Mac_`, `Android_`, `CRX_`\n\n**Example:** `MAL_Win_Emotet_Loader_Jan25`\n\nSee [style-guide.md](references\u002Fstyle-guide.md) for full conventions, metadata requirements, and naming examples.\n\n### Required Metadata\n\nEvery rule needs: `description` (starts with \"Detects\"), `author`, `reference`, `date`.\n\n```yara\nmeta:\n    description = \"Detects Example malware via unique mutex and C2 path\"\n    author = \"Your Name \u003Cemail@example.com>\"\n    reference = \"https:\u002F\u002Fexample.com\u002Fanalysis\"\n    date = \"2025-01-29\"\n```\n\n### String Selection\n\n**Good:** Mutex names, PDB paths, C2 paths, stack strings, configuration markers\n**Bad:** API names, common executables, format specifiers, generic paths\n\nSee [strings.md](references\u002Fstrings.md) for the full decision tree and examples.\n\n### Condition Patterns\n\n**Order conditions for short-circuit:**\n1. `filesize \u003C 10MB` (instant)\n2. `uint16(0) == 0x5A4D` (nearly instant)\n3. String matches (cheap)\n4. Module checks (expensive)\n\nSee [performance.md](references\u002Fperformance.md) for detailed optimization patterns.\n\n## Workflow\n\n1. **Gather samples** — Multiple samples; single-sample rules are brittle\n2. **Extract candidates** — `yarGen -m samples\u002F --excludegood`\n3. **Validate quality** — Use decision tree; yarGen needs 80% filtering\n4. **Write initial rule** — Follow template with proper metadata\n5. **Lint and test** — `yr check`, `yr fmt`, linter script\n6. **Goodware validation** — VirusTotal corpus or local clean files\n7. **Deploy** — Add to repo with full metadata, monitor for FPs\n\nSee [testing.md](references\u002Ftesting.md) for detailed validation workflow and FP investigation.\n\nFor a comprehensive step-by-step guide covering all phases from sample collection to deployment, see [rule-development.md](workflows\u002Frule-development.md).\n\n## Common Mistakes\n\n| Mistake | Bad | Good |\n|---------|-----|------|\n| API names as indicators | `\"VirtualAlloc\"` | Hex pattern of call site + unique mutex |\n| Unbounded regex | `\u002Fhttps?:\\\u002F\\\u002F.*\u002F` | `\u002Fhttps?:\\\u002F\\\u002F[a-z0-9]{8,12}\\.onion\u002F` |\n| Missing file type filter | `pe.imports(...)` first | `uint16(0) == 0x5A4D and filesize \u003C 10MB` first |\n| Short strings | `\"abc\"` (3 bytes) | `\"abcdef\"` (4+ bytes) |\n| Unescaped braces (YARA-X) | `\u002Fconfig{key}\u002F` | `\u002Fconfig\\{key\\}\u002F` |\n\n## Performance Optimization\n\n**Quick wins:** Put `filesize` first, avoid `nocase`, bounded regex `{1,100}`, prefer hex over regex.\n\n**Red flags:** Strings \u003C4 bytes, unbounded regex (`.*`), modules without file-type filter.\n\nSee [performance.md](references\u002Fperformance.md) for atom theory and optimization details.\n\n## Reference Documents\n\n| Topic | Document |\n|-------|----------|\n| Naming and metadata conventions | [style-guide.md](references\u002Fstyle-guide.md) |\n| Performance and atom optimization | [performance.md](references\u002Fperformance.md) |\n| String types and judgment | [strings.md](references\u002Fstrings.md) |\n| Testing and validation | [testing.md](references\u002Ftesting.md) |\n| Chrome extension module (crx) | [crx-module.md](references\u002Fcrx-module.md) |\n| Android DEX module (dex) | [dex-module.md](references\u002Fdex-module.md) |\n\n## Workflows\n\n| Topic | Document |\n|-------|----------|\n| Complete rule development process | [rule-development.md](workflows\u002Frule-development.md) |\n\n## Example Rules\n\nThe `examples\u002F` directory contains real, attributed rules demonstrating best practices:\n\n| Example | Demonstrates | Source |\n|---------|--------------|--------|\n| [MAL_Win_Remcos_Jan25.yar](examples\u002FMAL_Win_Remcos_Jan25.yar) | PE malware: graduated string counts, multiple rules per family | Elastic Security |\n| [MAL_Mac_ProtonRAT_Jan25.yar](examples\u002FMAL_Mac_ProtonRAT_Jan25.yar) | macOS: Mach-O magic bytes, multi-category grouping | Airbnb BinaryAlert |\n| [MAL_NPM_SupplyChain_Jan25.yar](examples\u002FMAL_NPM_SupplyChain_Jan25.yar) | npm supply chain: real attack patterns, ERC-20 selectors | Stairwell Research |\n| [SUSP_JS_Obfuscation_Jan25.yar](examples\u002FSUSP_JS_Obfuscation_Jan25.yar) | JavaScript: obfuscator detection, density-based matching | imp0rtp3, Nils Kuhnert |\n| [SUSP_CRX_SuspiciousPermissions.yar](examples\u002FSUSP_CRX_SuspiciousPermissions.yar) | Chrome extensions: crx module, permissions | Educational |\n\n## Scripts\n\n```bash\nuv run {baseDir}\u002Fscripts\u002Fyara_lint.py rule.yar      # Validate style\u002Fmetadata\nuv run {baseDir}\u002Fscripts\u002Fatom_analyzer.py rule.yar  # Check string quality\n```\n\nSee [README.md](..\u002F..\u002FREADME.md#scripts) for detailed script documentation.\n\n## Quality Checklist\n\nBefore deploying any rule:\n\n- [ ] Name follows `{CATEGORY}_{PLATFORM}_{FAMILY}_{VARIANT}_{DATE}` format\n- [ ] Description starts with \"Detects\" and explains what\u002Fhow\n- [ ] All required metadata present (author, reference, date)\n- [ ] Strings are unique (not API names, common paths, or format strings)\n- [ ] All strings have 4+ bytes with good atom potential\n- [ ] Base64 modifier only on strings with 3+ characters\n- [ ] Regex patterns have escaped `{` and valid escape sequences\n- [ ] Condition starts with cheap checks (filesize, magic bytes)\n- [ ] Rule matches all target samples\n- [ ] Rule produces zero matches on goodware corpus\n- [ ] `yr check` passes with no errors\n- [ ] `yr fmt --check` passes (consistent formatting)\n- [ ] Linter passes with no errors\n- [ ] Peer review completed\n\n## Resources\n\n### Quality YARA Rule Repositories\n\nLearn from production rules. These repositories contain well-tested, properly attributed rules:\n\n| Repository | Focus | Maintainer |\n|------------|-------|------------|\n| [Neo23x0\u002Fsignature-base](https:\u002F\u002Fgithub.com\u002FNeo23x0\u002Fsignature-base) | 17,000+ production rules, multi-platform | Florian Roth |\n| [Elastic\u002Fprotections-artifacts](https:\u002F\u002Fgithub.com\u002Felastic\u002Fprotections-artifacts) | 1,000+ endpoint-tested rules | Elastic Security |\n| [reversinglabs\u002Freversinglabs-yara-rules](https:\u002F\u002Fgithub.com\u002Freversinglabs\u002Freversinglabs-yara-rules) | Threat research rules | ReversingLabs |\n| [imp0rtp3\u002Fjs-yara-rules](https:\u002F\u002Fgithub.com\u002Fimp0rtp3\u002Fjs-yara-rules) | JavaScript\u002Fbrowser malware | imp0rtp3 |\n| [InQuest\u002Fawesome-yara](https:\u002F\u002Fgithub.com\u002FInQuest\u002Fawesome-yara) | Curated index of resources | InQuest |\n\n### Style & Performance Guides\n\n| Guide | Purpose |\n|-------|---------|\n| [YARA Style Guide](https:\u002F\u002Fgithub.com\u002FNeo23x0\u002FYARA-Style-Guide) | Naming conventions, metadata, string prefixes |\n| [YARA Performance Guidelines](https:\u002F\u002Fgithub.com\u002FNeo23x0\u002FYARA-Performance-Guidelines) | Atom optimization, regex bounds |\n| [Kaspersky Applied YARA Training](https:\u002F\u002Fyara.readthedocs.io\u002F) | Expert techniques from production use |\n\n### Tools\n\n| Tool | Purpose |\n|------|---------|\n| [yarGen](https:\u002F\u002Fgithub.com\u002FNeo23x0\u002FyarGen) | Extract candidate strings from samples |\n| [FLOSS](https:\u002F\u002Fgithub.com\u002Fmandiant\u002Fflare-floss) | Extract obfuscated and stack strings |\n| [YARA-CI](https:\u002F\u002Fyara-ci.cloud.virustotal.com\u002F) | Automated goodware testing |\n| [YaraDbg](https:\u002F\u002Fyaradbg.dev) | Web-based rule debugger |\n\n### macOS-Specific Resources\n\n| Resource | Purpose |\n|----------|---------|\n| Apple XProtect | Production macOS rules at `\u002FSystem\u002FLibrary\u002FCoreServices\u002FXProtect.bundle\u002F` |\n| [objective-see](https:\u002F\u002Fobjective-see.org\u002F) | macOS malware research and samples |\n| [macOS Security Tools](https:\u002F\u002Fgithub.com\u002F0xmachos\u002Fmacos-security-tools) | Reference list |\n\n### Multi-Indicator Clustering Pattern\n\nProduction rules often group indicators by type:\n\n```yara\nstrings:\n    \u002F\u002F Category A: Library indicators\n    $a1 = \"SRWebSocket\" ascii\n    $a2 = \"SocketRocket\" ascii\n\n    \u002F\u002F Category B: Behavioral indicators\n    $b1 = \"SSH tunnel\" ascii\n    $b2 = \"keylogger\" ascii nocase\n\n    \u002F\u002F Category C: C2 patterns\n    $c1 = \u002Fhttps:\\\u002F\\\u002F[a-z0-9]{8,16}\\.onion\u002F\n\ncondition:\n    filesize \u003C 10MB and\n    any of ($a*) and any of ($b*)  \u002F\u002F Require evidence from BOTH categories\n```\n\n**Why this works:** Different indicator types have different confidence levels. A single C2 domain might be definitive, while you need multiple library imports to be confident. Grouping by `$a*`, `$b*`, `$c*` lets you express graduated requirements.\n",{},"main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002Ftrailofbits\u002Fskills\u002Fyara-rule-authoring",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":7,"skillName":5,"commands":36,"prompt":46,"zipAvailable":47},[37,40,43],{"tool":38,"command":39},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill yara-rule-authoring",{"tool":41,"command":42},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill yara-rule-authoring",{"tool":44,"command":45},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill yara-rule-authoring","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Ftrailofbits\u002Fskills\u002Fyara-rule-authoring\u002FSKILL.md",true,[],[50,64,74,83,89,96],{"skillNo":51,"name":52,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":53,"categories":54,"keywords":60,"publishedAt":22},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[55],{"categoryNo":56,"categoryName":57,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[61,62,63],"model","model hierarchy","model hierarchy skill",{"skillNo":65,"name":66,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":67,"categories":68,"keywords":70,"publishedAt":22},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[69],{"categoryNo":56,"categoryName":57,"taxonomyType":58,"taxonomyTypeDesc":59},[71,72,73],"MCP","zoom","zoom mcp",{"skillNo":75,"name":76,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":77,"categories":78,"keywords":79,"publishedAt":22},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[80,81,82,72],"sdk","zoom apps sdk","apps",{"skillNo":84,"name":85,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":86,"categories":87,"keywords":88,"publishedAt":22},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[85],{"skillNo":90,"name":91,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":92,"categories":93,"keywords":95,"publishedAt":22},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[94],{"categoryNo":56,"categoryName":57,"taxonomyType":58,"taxonomyTypeDesc":59},[91],{"skillNo":97,"name":98,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":99,"categories":100,"keywords":101,"publishedAt":22},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[98]]