yara

Pattern matching tool for identifying and classifying malware. tldr-pages

On several platforms

Several platforms

Scan a specific file with a rule file

yara path/to/rule.yar path/to/fileIdentify

Recursively scan a directory and subdirectories containing possible threats

yara path/to/rule.yar --recursive path/to/directoryIdentify

Scan a running process by its PID using multiple rules

yara path/to/rule1.yar path/to/rule2.yar ... process_idIdentify

Print metadata associated with the matching rules

yara --print-meta path/to/rule.yar path/to/fileIdentify

Print the strings that caused the rule to match

yara --print-strings path/to/rule.yar path/to/fileIdentify

Use a specific number of threads for parallel scanning

yara --threads number_of_threads path/to/rule.yar path/to/directoryIdentify

Use compiled YARA rules file to scan a directory recursively

yara --compiled-rules path/to/rules.bin --recursive path/to/directoryIdentify