[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M73EPMPJYJZPATX3N8BSY8JM":3,"skill-same:01M73EPMPJYJZPATX3N8BSY8JM":90},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":23,"frontMatter":24,"refName":50,"commitSha":51,"skillDirectory":52,"forksCount":53,"repositoryHtmlUrl":54,"repositoryHomepageUrl":55,"ownerHtmlUrl":56,"ownerBlogUrl":57,"ownerDescription":58,"updatedAt":59,"install":60,"resources":73},"01M73EPMPJYJZPATX3N8BSY8JM","performing-malware-triage-with-yara",null,"Performs rapid malware triage and classification using YARA rules to match file patterns, strings, byte sequences, and structural characteristics against known malware families and suspicious indicators. Covers rule writing, scanning, and integration with analysis pipelines. Activates for requests involving YARA rule creation, malware classification, pattern matching, sample triage, or signature-based detection.","Horonomos-laps\u002FYana-AI","Horonomos-laps","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F355299122?v=4","01M76B3QPXE88ET2SQPDPVATZT"," Horonomos-laps","01M72ZQRJPCYPSSWT4D00VJR2A",13,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fperforming-malware-triage-with-yara\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fperforming-malware-triage-with-yara\u002FSKILL.md",[],[],"2026-11-11 15:11:14",false,"---\nname: performing-malware-triage-with-yara\ndescription: 'Performs rapid malware triage and classification using YARA rules to\n  match file patterns, strings, byte sequences, and structural characteristics against\n  known malware families and suspicious indicators. Covers rule writing, scanning,\n  and integration with analysis pipelines. Activates for requests involving YARA rule\n  creation, malware classification, pattern matching, sample triage, or signature-based\n  detection.\n\n  '\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- malware\n- YARA\n- triage\n- classification\n- pattern-matching\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmitre_attack:\n- T1027\n- T1055\n- T1140\n- T1497\n- T0816\nsource: https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\nsource_commit: 04450304b12645cb2b974ab96d28c0664758a88d\nnote: \"Vendored verbatim from an external Apache-2.0 security-skill library, pinned by commit. Exceeds the internal 300-line skill guideline (agent-code-constraints.md) -- kept as-is because this is vendored reference material (forensics\u002Fthreat-intel procedure), not Yana AI-authored content, and trimming would damage technical accuracy.\"\n---\n\n# Performing Malware Triage with YARA\n\n## When to Use\n\n- Rapidly classifying a large batch of malware samples against known family signatures\n- Writing detection rules for a newly analyzed malware family based on unique byte patterns\n- Scanning file shares, endpoints, or memory dumps for indicators of a specific threat\n- Building automated triage pipelines that classify samples before manual analysis\n- Hunting for variants of a known threat across an enterprise using YARA scans\n\n**Do not use** as the sole analysis method; YARA triage identifies known patterns but does not reveal new or unknown malware behaviors.\n\n## Prerequisites\n\n- YARA 4.x installed (`apt install yara` or `pip install yara-python`)\n- YARA rule repositories (YARA-Rules, awesome-yara, Malpedia rules, Florian Roth's signature-base)\n- Python 3.8+ with `yara-python` for scripted scanning\n- Sample collection organized in a directory structure for batch scanning\n- Understanding of PE file format, hex patterns, and regular expressions for rule writing\n\n## Workflow\n\n### Step 1: Scan Samples with Existing Rule Sets\n\nApply community and commercial YARA rules to classify samples:\n\n```bash\n# Scan a single file\nyara -s malware_rules.yar suspect.exe\n\n# Scan a directory of samples\nyara -r malware_rules.yar \u002Fpath\u002Fto\u002Fsamples\u002F\n\n# Scan with multiple rule files\nyara -r rules\u002Fapt_rules.yar rules\u002Fransomware_rules.yar rules\u002Ftrojan_rules.yar suspect.exe\n\n# Scan with timeout (prevent hanging on large files)\nyara -t 30 malware_rules.yar suspect.exe\n\n# Scan and show matching strings\nyara -s -r malware_rules.yar suspect.exe\n\n# Scan with compiled rules (faster for repeated scans)\nyarac malware_rules.yar compiled_rules.yarc\nyara compiled_rules.yarc suspect.exe\n```\n\n```bash\n# Download community rule sets\ngit clone https:\u002F\u002Fgithub.com\u002FYara-Rules\u002Frules.git yara-community-rules\ngit clone https:\u002F\u002Fgithub.com\u002FNeo23x0\u002Fsignature-base.git signature-base\n\n# Scan with signature-base\nyara -r signature-base\u002Fyara\u002F*.yar suspect.exe\n```\n\n### Step 2: Write Rules for Unique String Patterns\n\nCreate YARA rules based on strings extracted during malware analysis:\n\n```\nrule MalwareX_Strings {\n    meta:\n        description = \"Detects MalwareX based on unique strings\"\n        author = \"analyst\"\n        date = \"2025-09-15\"\n        reference = \"Internal Analysis Report #1547\"\n        hash = \"e3b0c44298fc1c149afbf4c8996fb924\"\n        tlp = \"WHITE\"\n\n    strings:\n        \u002F\u002F C2 URL pattern\n        $url1 = \"\u002Fgate.php?id=\" ascii\n        $url2 = \"\u002Fpanel\u002Fconnect.php\" ascii\n\n        \u002F\u002F Unique mutex name\n        $mutex = \"Global\\\\CryptLocker_2025\" ascii wide\n\n        \u002F\u002F User-Agent string\n        $ua = \"Mozilla\u002F5.0 (compatible; MSIE 10.0)\" ascii\n\n        \u002F\u002F Registry persistence path\n        $reg = \"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\WindowsUpdate\" ascii\n\n        \u002F\u002F Campaign identifier\n        $campaign = \"campaign_2025_q3\" ascii\n\n    condition:\n        uint16(0) == 0x5A4D and      \u002F\u002F PE file (MZ header)\n        filesize \u003C 500KB and          \u002F\u002F Size constraint\n        ($url1 or $url2) and          \u002F\u002F At least one C2 URL\n        ($mutex or $campaign) and     \u002F\u002F Campaign identifier\n        $ua                           \u002F\u002F Specific User-Agent\n}\n```\n\n### Step 3: Write Rules for Byte Patterns\n\nCreate rules matching specific code sequences:\n\n```\nrule MalwareX_Decryptor {\n    meta:\n        description = \"Detects MalwareX XOR decryption routine\"\n        author = \"analyst\"\n        date = \"2025-09-15\"\n\n    strings:\n        \u002F\u002F XOR decryption loop (x86 assembly)\n        \u002F\u002F mov al, [esi+ecx]\n        \u002F\u002F xor al, [edi+ecx]\n        \u002F\u002F mov [esi+ecx], al\n        \u002F\u002F inc ecx\n        \u002F\u002F cmp ecx, edx\n        \u002F\u002F jl loop\n        $xor_loop = { 8A 04 0E 32 04 0F 88 04 0E 41 3B CA 7C F3 }\n\n        \u002F\u002F RC4 KSA initialization (256-byte loop)\n        $rc4_ksa = { 33 C0 88 04 ?8 40 3D 00 01 00 00 7? }\n\n        \u002F\u002F Embedded RSA public key marker\n        $rsa_key = { 06 02 00 00 00 A4 00 00 52 53 41 31 }  \u002F\u002F PUBLICKEYBLOB\n\n    condition:\n        uint16(0) == 0x5A4D and\n        ($xor_loop or $rc4_ksa) and\n        $rsa_key\n}\n```\n\n### Step 4: Write Rules with PE Module\n\nLeverage YARA's PE module for structural detection:\n\n```\nimport \"pe\"\nimport \"hash\"\nimport \"math\"\n\nrule MalwareX_PE_Characteristics {\n    meta:\n        description = \"Detects MalwareX by PE structure and imports\"\n        author = \"analyst\"\n\n    condition:\n        pe.is_pe and\n\n        \u002F\u002F Compiled within specific timeframe\n        pe.timestamp > 1693526400 and   \u002F\u002F After 2023-09-01\n        pe.timestamp \u003C 1727740800 and   \u002F\u002F Before 2024-10-01\n\n        \u002F\u002F Specific import hash\n        pe.imphash() == \"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6\" or\n\n        \u002F\u002F Suspicious import combination\n        (\n            pe.imports(\"kernel32.dll\", \"VirtualAllocEx\") and\n            pe.imports(\"kernel32.dll\", \"WriteProcessMemory\") and\n            pe.imports(\"kernel32.dll\", \"CreateRemoteThread\") and\n            pe.imports(\"wininet.dll\", \"InternetOpenA\")\n        ) or\n\n        \u002F\u002F High entropy .text section (packed)\n        (\n            for any section in pe.sections : (\n                section.name == \".text\" and\n                math.entropy(section.raw_data_offset, section.raw_data_size) > 7.0\n            )\n        )\n}\n\nrule MalwareX_Rich_Header {\n    meta:\n        description = \"Detects MalwareX by Rich header hash\"\n\n    condition:\n        pe.is_pe and\n        hash.md5(pe.rich_signature.clear_data) == \"abc123def456abc123def456abc123de\"\n}\n```\n\n### Step 5: Batch Triage with Python\n\nAutomate scanning of sample collections:\n\n```python\nimport yara\nimport os\nimport json\nimport hashlib\nfrom datetime import datetime\n\n# Compile all rule files\nrule_files = {\n    \"apt\": \"rules\u002Fapt_rules.yar\",\n    \"ransomware\": \"rules\u002Fransomware_rules.yar\",\n    \"trojan\": \"rules\u002Ftrojan_rules.yar\",\n    \"custom\": \"rules\u002Fcustom_rules.yar\",\n}\nrules = yara.compile(filepaths=rule_files)\n\n# Scan sample directory\nresults = []\nsample_dir = \"\u002Fpath\u002Fto\u002Fsamples\"\n\nfor filename in os.listdir(sample_dir):\n    filepath = os.path.join(sample_dir, filename)\n    if not os.path.isfile(filepath):\n        continue\n\n    with open(filepath, \"rb\") as f:\n        data = f.read()\n        sha256 = hashlib.sha256(data).hexdigest()\n\n    matches = rules.match(filepath)\n\n    result = {\n        \"filename\": filename,\n        \"sha256\": sha256,\n        \"size\": len(data),\n        \"matches\": [],\n        \"classification\": \"UNKNOWN\",\n    }\n\n    for match in matches:\n        result[\"matches\"].append({\n            \"rule\": match.rule,\n            \"namespace\": match.namespace,\n            \"tags\": match.tags,\n            \"strings\": [(hex(s[0]), s[1], s[2].decode(\"utf-8\", errors=\"replace\")[:100])\n                       for s in match.strings] if match.strings else []\n        })\n\n    if result[\"matches\"]:\n        result[\"classification\"] = result[\"matches\"][0][\"namespace\"].upper()\n\n    results.append(result)\n\n# Summary\nclassified = sum(1 for r in results if r[\"classification\"] != \"UNKNOWN\")\nprint(f\"Scanned: {len(results)} samples\")\nprint(f\"Classified: {classified} ({classified\u002Flen(results)*100:.1f}%)\")\nprint(f\"Unknown: {len(results)-classified}\")\n\n# Export results\nwith open(\"triage_results.json\", \"w\") as f:\n    json.dump(results, f, indent=2)\n```\n\n### Step 6: Validate and Optimize Rules\n\nTest rules for false positives and performance:\n\n```bash\n# Test rule syntax\nyara -C custom_rules.yar\n\n# Scan known-clean directory to check false positives\nyara -r custom_rules.yar \u002Fpath\u002Fto\u002Fclean_files\u002F > false_positives.txt\nwc -l false_positives.txt\n\n# Benchmark rule performance\ntime yara -r custom_rules.yar \u002Fpath\u002Fto\u002Flarge_sample_collection\u002F\n\n# Profile individual rule performance\nyara -p custom_rules.yar suspect.exe\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **YARA Rule** | Pattern matching rule defining strings, byte sequences, and conditions that identify a specific file or malware family |\n| **Condition** | Boolean expression combining string matches, file properties, and module functions to determine if a rule matches |\n| **Hex String** | Byte pattern with optional wildcards (??) and jumps ([N-M]) for matching machine code or binary data |\n| **PE Module** | YARA module providing access to PE file properties (imports, sections, timestamps, resources) for structural matching |\n| **Imphash** | MD5 hash of a PE file's import table; samples from the same family often share import hashes |\n| **Rich Header** | Undocumented PE structure containing compiler\u002Flinker metadata; consistent within malware build environments |\n| **YARA-C** | Compiled YARA rule format enabling faster scanning by pre-compiling rules for repeated use |\n\n## Tools & Systems\n\n- **YARA**: Pattern matching engine for identifying and classifying malware based on text, hex, and structural patterns\n- **yara-python**: Python bindings for YARA enabling scripted scanning, rule compilation, and integration with analysis pipelines\n- **yarGen**: Automatic YARA rule generator that creates rules from malware samples by identifying unique strings and opcodes\n- **YARA-Rules (GitHub)**: Community-maintained repository of YARA rules covering malware families, exploits, and suspicious indicators\n- **Malpedia YARA**: Curated YARA rules from the Malpedia malware encyclopedia with high-quality family-specific rules\n\n## Common Scenarios\n\n### Scenario: Creating Detection Rules for a New Malware Family\n\n**Context**: Reverse engineering of a new malware sample has identified unique strings, byte patterns, and PE characteristics. YARA rules are needed for enterprise-wide hunting and ongoing detection.\n\n**Approach**:\n1. Extract unique strings from the unpacked binary (C2 URLs, mutex names, registry paths)\n2. Identify unique byte sequences from the encryption routine or C2 protocol (from Ghidra analysis)\n3. Record PE characteristics (imphash, Rich header hash, section names, compilation timestamp range)\n4. Write a YARA rule combining string, byte pattern, and PE module conditions\n5. Test against the known malware samples to confirm true positive detection\n6. Test against a clean file corpus (Windows system files, common applications) to verify zero false positives\n7. Deploy to enterprise scanning infrastructure and threat intelligence platform\n\n**Pitfalls**:\n- Writing rules too specific to a single sample (will not detect variants with minor changes)\n- Writing rules too generic (matching legitimate software, causing false positives)\n- Using strings that appear in common libraries or frameworks (e.g., OpenSSL strings)\n- Not testing on a sufficiently large clean corpus before deployment\n\n## Output Format\n\n```\nYARA TRIAGE RESULTS\n=====================\nScan Date:        2025-09-15\nRule Sets:        apt_rules (847 rules), ransomware_rules (312 rules),\n                  trojan_rules (1,204 rules), custom_rules (45 rules)\nSamples Scanned:  2,500\nProcessing Time:  47 seconds\n\nCLASSIFICATION SUMMARY\nAPT:              12 samples (0.5%)\nRansomware:       187 samples (7.5%)\nTrojan:           423 samples (16.9%)\nUnknown:          1,878 samples (75.1%)\n\nTOP MATCHING RULES\nRule                         Matches  Family\nMalwareX_C2_Beacon           45       MalwareX\nLockBit3_Ransom_Note         38       LockBit 3.0\nEmotet_Epoch5_Loader         32       Emotet\nCobaltStrike_Beacon_Config   28       Cobalt Strike\nQakBot_DLL_Loader            25       QakBot\n\nSAMPLE DETAIL\nFile:    suspect.exe\nSHA-256: e3b0c44298fc1c149afbf4c8996fb924...\nMatches:\n  [1] MalwareX_Strings (custom)\n      - $url1 at 0x4A20: \"\u002Fgate.php?id=\"\n      - $mutex at 0x5100: \"Global\\\\CryptLocker_2025\"\n  [2] MalwareX_Decryptor (custom)\n      - $xor_loop at 0x401200: { 8A 04 0E 32 04 0F ... }\n  [3] MalwareX_PE_Characteristics (custom)\n      - PE import combination matched\nClassification: MALWAREX (HIGH CONFIDENCE)\n```\n","# Performing Malware Triage with YARA\n\n## When to Use\n\n- Rapidly classifying a large batch of malware samples against known family signatures\n- Writing detection rules for a newly analyzed malware family based on unique byte patterns\n- Scanning file shares, endpoints, or memory dumps for indicators of a specific threat\n- Building automated triage pipelines that classify samples before manual analysis\n- Hunting for variants of a known threat across an enterprise using YARA scans\n\n**Do not use** as the sole analysis method; YARA triage identifies known patterns but does not reveal new or unknown malware behaviors.\n\n## Prerequisites\n\n- YARA 4.x installed (`apt install yara` or `pip install yara-python`)\n- YARA rule repositories (YARA-Rules, awesome-yara, Malpedia rules, Florian Roth's signature-base)\n- Python 3.8+ with `yara-python` for scripted scanning\n- Sample collection organized in a directory structure for batch scanning\n- Understanding of PE file format, hex patterns, and regular expressions for rule writing\n\n## Workflow\n\n### Step 1: Scan Samples with Existing Rule Sets\n\nApply community and commercial YARA rules to classify samples:\n\n```bash\n# Scan a single file\nyara -s malware_rules.yar suspect.exe\n\n# Scan a directory of samples\nyara -r malware_rules.yar \u002Fpath\u002Fto\u002Fsamples\u002F\n\n# Scan with multiple rule files\nyara -r rules\u002Fapt_rules.yar rules\u002Fransomware_rules.yar rules\u002Ftrojan_rules.yar suspect.exe\n\n# Scan with timeout (prevent hanging on large files)\nyara -t 30 malware_rules.yar suspect.exe\n\n# Scan and show matching strings\nyara -s -r malware_rules.yar suspect.exe\n\n# Scan with compiled rules (faster for repeated scans)\nyarac malware_rules.yar compiled_rules.yarc\nyara compiled_rules.yarc suspect.exe\n```\n\n```bash\n# Download community rule sets\ngit clone https:\u002F\u002Fgithub.com\u002FYara-Rules\u002Frules.git yara-community-rules\ngit clone https:\u002F\u002Fgithub.com\u002FNeo23x0\u002Fsignature-base.git signature-base\n\n# Scan with signature-base\nyara -r signature-base\u002Fyara\u002F*.yar suspect.exe\n```\n\n### Step 2: Write Rules for Unique String Patterns\n\nCreate YARA rules based on strings extracted during malware analysis:\n\n```\nrule MalwareX_Strings {\n    meta:\n        description = \"Detects MalwareX based on unique strings\"\n        author = \"analyst\"\n        date = \"2025-09-15\"\n        reference = \"Internal Analysis Report #1547\"\n        hash = \"e3b0c44298fc1c149afbf4c8996fb924\"\n        tlp = \"WHITE\"\n\n    strings:\n        \u002F\u002F C2 URL pattern\n        $url1 = \"\u002Fgate.php?id=\" ascii\n        $url2 = \"\u002Fpanel\u002Fconnect.php\" ascii\n\n        \u002F\u002F Unique mutex name\n        $mutex = \"Global\\\\CryptLocker_2025\" ascii wide\n\n        \u002F\u002F User-Agent string\n        $ua = \"Mozilla\u002F5.0 (compatible; MSIE 10.0)\" ascii\n\n        \u002F\u002F Registry persistence path\n        $reg = \"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\WindowsUpdate\" ascii\n\n        \u002F\u002F Campaign identifier\n        $campaign = \"campaign_2025_q3\" ascii\n\n    condition:\n        uint16(0) == 0x5A4D and      \u002F\u002F PE file (MZ header)\n        filesize \u003C 500KB and          \u002F\u002F Size constraint\n        ($url1 or $url2) and          \u002F\u002F At least one C2 URL\n        ($mutex or $campaign) and     \u002F\u002F Campaign identifier\n        $ua                           \u002F\u002F Specific User-Agent\n}\n```\n\n### Step 3: Write Rules for Byte Patterns\n\nCreate rules matching specific code sequences:\n\n```\nrule MalwareX_Decryptor {\n    meta:\n        description = \"Detects MalwareX XOR decryption routine\"\n        author = \"analyst\"\n        date = \"2025-09-15\"\n\n    strings:\n        \u002F\u002F XOR decryption loop (x86 assembly)\n        \u002F\u002F mov al, [esi+ecx]\n        \u002F\u002F xor al, [edi+ecx]\n        \u002F\u002F mov [esi+ecx], al\n        \u002F\u002F inc ecx\n        \u002F\u002F cmp ecx, edx\n        \u002F\u002F jl loop\n        $xor_loop = { 8A 04 0E 32 04 0F 88 04 0E 41 3B CA 7C F3 }\n\n        \u002F\u002F RC4 KSA initialization (256-byte loop)\n        $rc4_ksa = { 33 C0 88 04 ?8 40 3D 00 01 00 00 7? }\n\n        \u002F\u002F Embedded RSA public key marker\n        $rsa_key = { 06 02 00 00 00 A4 00 00 52 53 41 31 }  \u002F\u002F PUBLICKEYBLOB\n\n    condition:\n        uint16(0) == 0x5A4D and\n        ($xor_loop or $rc4_ksa) and\n        $rsa_key\n}\n```\n\n### Step 4: Write Rules with PE Module\n\nLeverage YARA's PE module for structural detection:\n\n```\nimport \"pe\"\nimport \"hash\"\nimport \"math\"\n\nrule MalwareX_PE_Characteristics {\n    meta:\n        description = \"Detects MalwareX by PE structure and imports\"\n        author = \"analyst\"\n\n    condition:\n        pe.is_pe and\n\n        \u002F\u002F Compiled within specific timeframe\n        pe.timestamp > 1693526400 and   \u002F\u002F After 2023-09-01\n        pe.timestamp \u003C 1727740800 and   \u002F\u002F Before 2024-10-01\n\n        \u002F\u002F Specific import hash\n        pe.imphash() == \"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6\" or\n\n        \u002F\u002F Suspicious import combination\n        (\n            pe.imports(\"kernel32.dll\", \"VirtualAllocEx\") and\n            pe.imports(\"kernel32.dll\", \"WriteProcessMemory\") and\n            pe.imports(\"kernel32.dll\", \"CreateRemoteThread\") and\n            pe.imports(\"wininet.dll\", \"InternetOpenA\")\n        ) or\n\n        \u002F\u002F High entropy .text section (packed)\n        (\n            for any section in pe.sections : (\n                section.name == \".text\" and\n                math.entropy(section.raw_data_offset, section.raw_data_size) > 7.0\n            )\n        )\n}\n\nrule MalwareX_Rich_Header {\n    meta:\n        description = \"Detects MalwareX by Rich header hash\"\n\n    condition:\n        pe.is_pe and\n        hash.md5(pe.rich_signature.clear_data) == \"abc123def456abc123def456abc123de\"\n}\n```\n\n### Step 5: Batch Triage with Python\n\nAutomate scanning of sample collections:\n\n```python\nimport yara\nimport os\nimport json\nimport hashlib\nfrom datetime import datetime\n\n# Compile all rule files\nrule_files = {\n    \"apt\": \"rules\u002Fapt_rules.yar\",\n    \"ransomware\": \"rules\u002Fransomware_rules.yar\",\n    \"trojan\": \"rules\u002Ftrojan_rules.yar\",\n    \"custom\": \"rules\u002Fcustom_rules.yar\",\n}\nrules = yara.compile(filepaths=rule_files)\n\n# Scan sample directory\nresults = []\nsample_dir = \"\u002Fpath\u002Fto\u002Fsamples\"\n\nfor filename in os.listdir(sample_dir):\n    filepath = os.path.join(sample_dir, filename)\n    if not os.path.isfile(filepath):\n        continue\n\n    with open(filepath, \"rb\") as f:\n        data = f.read()\n        sha256 = hashlib.sha256(data).hexdigest()\n\n    matches = rules.match(filepath)\n\n    result = {\n        \"filename\": filename,\n        \"sha256\": sha256,\n        \"size\": len(data),\n        \"matches\": [],\n        \"classification\": \"UNKNOWN\",\n    }\n\n    for match in matches:\n        result[\"matches\"].append({\n            \"rule\": match.rule,\n            \"namespace\": match.namespace,\n            \"tags\": match.tags,\n            \"strings\": [(hex(s[0]), s[1], s[2].decode(\"utf-8\", errors=\"replace\")[:100])\n                       for s in match.strings] if match.strings else []\n        })\n\n    if result[\"matches\"]:\n        result[\"classification\"] = result[\"matches\"][0][\"namespace\"].upper()\n\n    results.append(result)\n\n# Summary\nclassified = sum(1 for r in results if r[\"classification\"] != \"UNKNOWN\")\nprint(f\"Scanned: {len(results)} samples\")\nprint(f\"Classified: {classified} ({classified\u002Flen(results)*100:.1f}%)\")\nprint(f\"Unknown: {len(results)-classified}\")\n\n# Export results\nwith open(\"triage_results.json\", \"w\") as f:\n    json.dump(results, f, indent=2)\n```\n\n### Step 6: Validate and Optimize Rules\n\nTest rules for false positives and performance:\n\n```bash\n# Test rule syntax\nyara -C custom_rules.yar\n\n# Scan known-clean directory to check false positives\nyara -r custom_rules.yar \u002Fpath\u002Fto\u002Fclean_files\u002F > false_positives.txt\nwc -l false_positives.txt\n\n# Benchmark rule performance\ntime yara -r custom_rules.yar \u002Fpath\u002Fto\u002Flarge_sample_collection\u002F\n\n# Profile individual rule performance\nyara -p custom_rules.yar suspect.exe\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **YARA Rule** | Pattern matching rule defining strings, byte sequences, and conditions that identify a specific file or malware family |\n| **Condition** | Boolean expression combining string matches, file properties, and module functions to determine if a rule matches |\n| **Hex String** | Byte pattern with optional wildcards (??) and jumps ([N-M]) for matching machine code or binary data |\n| **PE Module** | YARA module providing access to PE file properties (imports, sections, timestamps, resources) for structural matching |\n| **Imphash** | MD5 hash of a PE file's import table; samples from the same family often share import hashes |\n| **Rich Header** | Undocumented PE structure containing compiler\u002Flinker metadata; consistent within malware build environments |\n| **YARA-C** | Compiled YARA rule format enabling faster scanning by pre-compiling rules for repeated use |\n\n## Tools & Systems\n\n- **YARA**: Pattern matching engine for identifying and classifying malware based on text, hex, and structural patterns\n- **yara-python**: Python bindings for YARA enabling scripted scanning, rule compilation, and integration with analysis pipelines\n- **yarGen**: Automatic YARA rule generator that creates rules from malware samples by identifying unique strings and opcodes\n- **YARA-Rules (GitHub)**: Community-maintained repository of YARA rules covering malware families, exploits, and suspicious indicators\n- **Malpedia YARA**: Curated YARA rules from the Malpedia malware encyclopedia with high-quality family-specific rules\n\n## Common Scenarios\n\n### Scenario: Creating Detection Rules for a New Malware Family\n\n**Context**: Reverse engineering of a new malware sample has identified unique strings, byte patterns, and PE characteristics. YARA rules are needed for enterprise-wide hunting and ongoing detection.\n\n**Approach**:\n1. Extract unique strings from the unpacked binary (C2 URLs, mutex names, registry paths)\n2. Identify unique byte sequences from the encryption routine or C2 protocol (from Ghidra analysis)\n3. Record PE characteristics (imphash, Rich header hash, section names, compilation timestamp range)\n4. Write a YARA rule combining string, byte pattern, and PE module conditions\n5. Test against the known malware samples to confirm true positive detection\n6. Test against a clean file corpus (Windows system files, common applications) to verify zero false positives\n7. Deploy to enterprise scanning infrastructure and threat intelligence platform\n\n**Pitfalls**:\n- Writing rules too specific to a single sample (will not detect variants with minor changes)\n- Writing rules too generic (matching legitimate software, causing false positives)\n- Using strings that appear in common libraries or frameworks (e.g., OpenSSL strings)\n- Not testing on a sufficiently large clean corpus before deployment\n\n## Output Format\n\n```\nYARA TRIAGE RESULTS\n=====================\nScan Date:        2025-09-15\nRule Sets:        apt_rules (847 rules), ransomware_rules (312 rules),\n                  trojan_rules (1,204 rules), custom_rules (45 rules)\nSamples Scanned:  2,500\nProcessing Time:  47 seconds\n\nCLASSIFICATION SUMMARY\nAPT:              12 samples (0.5%)\nRansomware:       187 samples (7.5%)\nTrojan:           423 samples (16.9%)\nUnknown:          1,878 samples (75.1%)\n\nTOP MATCHING RULES\nRule                         Matches  Family\nMalwareX_C2_Beacon           45       MalwareX\nLockBit3_Ransom_Note         38       LockBit 3.0\nEmotet_Epoch5_Loader         32       Emotet\nCobaltStrike_Beacon_Config   28       Cobalt Strike\nQakBot_DLL_Loader            25       QakBot\n\nSAMPLE DETAIL\nFile:    suspect.exe\nSHA-256: e3b0c44298fc1c149afbf4c8996fb924...\nMatches:\n  [1] MalwareX_Strings (custom)\n      - $url1 at 0x4A20: \"\u002Fgate.php?id=\"\n      - $mutex at 0x5100: \"Global\\\\CryptLocker_2025\"\n  [2] MalwareX_Decryptor (custom)\n      - $xor_loop at 0x401200: { 8A 04 0E 32 04 0F ... }\n  [3] MalwareX_PE_Characteristics (custom)\n      - PE import combination matched\nClassification: MALWAREX (HIGH CONFIDENCE)\n```\n",{"name":5,"note":25,"tags":26,"author":32,"domain":33,"source":34,"license":15,"version":35,"nist_csf":36,"subdomain":41,"description":42,"mitre_attack":43,"source_commit":49},"Vendored verbatim from an external Apache-2.0 security-skill library, pinned by commit. Exceeds the internal 300-line skill guideline (agent-code-constraints.md) -- kept as-is because this is vendored reference material (forensics\u002Fthreat-intel procedure), not Yana AI-authored content, and trimming would damage technical accuracy.",[27,28,29,30,31],"malware","YARA","triage","classification","pattern-matching","mahipal","cybersecurity","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","1.0.0",[37,38,39,40],"DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01","malware-analysis","Performs rapid malware triage and classification using YARA rules to match file patterns, strings, byte sequences, and structural characteristics against known malware families and suspicious indicators. Covers rule writing, scanning, and integration with analysis pipelines. Activates for requests involving YARA rule creation, malware classification, pattern matching, sample triage, or signature-based detection.\n",[44,45,46,47,48],"T1027","T1055","T1140","T1497","T0816","04450304b12645cb2b974ab96d28c0664758a88d","main","481dcd7dd2e288b9d627a2bd017db70e64e6c6fa","core\u002Fskills\u002Fperforming-malware-triage-with-yara",2,"https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI","https:\u002F\u002Fyana.vutam.link\u002F","https:\u002F\u002Fgithub.com\u002FHoronomos-laps","https:\u002F\u002Fyana.vutam.link","An open-source governed runtime & execution environment for multi-agent AI systems.","2026-11-13 13:15:29",{"source":8,"skillName":5,"commands":61,"prompt":71,"zipAvailable":72},[62,65,68],{"tool":63,"command":64},"npx","npx skills add Horonomos-laps\u002FYana-AI --skill performing-malware-triage-with-yara",{"tool":66,"command":67},"bunx","bunx skills add Horonomos-laps\u002FYana-AI --skill performing-malware-triage-with-yara",{"tool":69,"command":70},"pnpm","pnpm dlx skills add Horonomos-laps\u002FYana-AI --skill performing-malware-triage-with-yara","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fperforming-malware-triage-with-yara\u002FSKILL.md",true,[74,78,84],{"path":75,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":77,"sourceHtmlUrl":16},"LICENSE","许可证",11255,{"path":79,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":82,"sourceHtmlUrl":83},"references\u002Fapi-reference.md","REFERENCE","参考文档",1628,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fperforming-malware-triage-with-yara\u002Freferences\u002Fapi-reference.md",{"path":85,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":88,"sourceHtmlUrl":89},"scripts\u002Fagent.py","SCRIPT","脚本",6433,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fperforming-malware-triage-with-yara\u002Fscripts\u002Fagent.py",[91,99,106,114,122,130],{"skillNo":92,"name":93,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":95,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":98,"publishedAt":20},"01M735GKET5YVYKAY62W2P5YXB","openai--sentry--sentry","Use when the user asks to inspect Sentry issues or events, summarize recent production errors, or pull basic Sentry health data via the Sentry API; perform read-only queries with the bundled script and require `SENTRY_AUTH_TOKEN`.","MIT","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fopenai--sentry--sentry\u002FSKILL.md",[],[],{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":105,"publishedAt":20},"01M73DCAP83T17HY7SMGK7MGFE","ito-basket-compare","Compare Itô prediction-market baskets against a user's knowledge base, portfolio notes, financial context, watchlist, or research thesis. Use for read-only basket comparison and gap analysis without investment advice or live trading.","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fito-basket-compare\u002FSKILL.md",[],[],{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":110,"sourceHtmlUrl":111,"categories":112,"keywords":113,"publishedAt":20},"01M734CYEMZFDR3KH6SW0JP8TD","implementing-network-traffic-baselining","Build network traffic baselines from NetFlow\u002FIPFIX data using Python pandas for statistical analysis, z-score anomaly detection, and hourly\u002Fdaily traffic pattern profiling","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FSKILL.md",[],[],{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":118,"sourceHtmlUrl":119,"categories":120,"keywords":121,"publishedAt":20},"01M73ASZ6NJRJM44Z2P84NGQ3Q","detecting-evasion-techniques-in-endpoint-logs","Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FSKILL.md",[],[],{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":126,"sourceHtmlUrl":127,"categories":128,"keywords":129,"publishedAt":20},"01M734AFNXD06Z78QRK0VKGT7Q","implementing-microsegmentation-with-guardicore","Implementing microsegmentation using Akamai Guardicore Segmentation to map application dependencies, create granular network policies, visualize east-west traffic flows, and enforce least-privilege communication between workloads across data centers and cloud.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FSKILL.md",[],[],{"skillNo":131,"name":132,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":135,"publishedAt":20},"01M736TK27QMCXK0DVCH25SJN5","ramdisk-tmpfs-patterns","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Framdisk-tmpfs-patterns\u002FSKILL.md",[],[]]