## YARA Rules\n\n### What is YARA?\n\nYARA is a pattern-matching tool used to identify and classify malware. Think of it as "grep for malware."\n\n### YARA Rule Structure\n\n```yara\nrule RuleName {\n    meta:\n        author = "Your Name"\n        description = "What it detects"\n        date = "2024-01-15"\n        \n    strings:\n        $s1 = "suspicious string" ascii\n        $s2 = { 4D 5A 90 00 }  // hex pattern\n        $s3 = /https?:\\/\\/[a-z0-9]+\\.evil\\.com/ // regex\n        \n    condition:\n        uint16(0) == 0x5A4D and  // MZ header\n        2 of ($s*)\n}\n```\n\n### String Types\n\n| Type | Syntax | Example |\n|------|--------|--------|\n| Text | "string" | "CreateRemoteThread" |\n| Hex | { XX XX } | { 4D 5A 90 00 } |\n| Regex | /pattern/ | /cmd\\.exe.*\\/c/ |\n\n### Modifiers\n\n- `ascii` - ASCII strings\n- `wide` - UTF-16 (Windows)\n- `nocase` - Case insensitive\n- `fullword` - Match whole word only\n\n### Condition Operators\n\n```yara\ncondition:\n    all of them           // All strings must match\n    any of ($a*)          // Any string starting with $a\n    2 of ($s1, $s2, $s3)  // At least 2 must match\n    #s1 > 5               // $s1 appears more than 5 times\n    @s1[1] < 100          // First occurrence before byte 100\n    filesize < 1MB        // File size condition\n```\n\n### Best Practices\n\n✅ Use unique strings (avoid common APIs)\n✅ Combine multiple indicators\n✅ Test against goodware to reduce FPs\n✅ Include metadata for context\n❌ Don't rely on single strings\n❌ Don't use overly broad patterns