yara(1) General Commands Manual yara(1)

# [NAME](#NAME)

yara - find files matching patterns and rules written in a special-purpose language.

# [SYNOPSIS](#SYNOPSIS)

**yara** \[OPTION]... \[NAMESPACE:]RULES\_FILE... FILE | DIR | PID

# [DESCRIPTION](#DESCRIPTION)

yara scans the given FILE, all files contained in directory DIR, or the process identified by PID looking for matches of patterns and rules provided in a special purpose-language. The rules are read from one or more RULES\_FILE.

The options to [*yara*(1)](/man/os/yara/yara.1) are:

[**--atom-quality-table**](#atom-quality-table)

Path to a file with the atom quality table.

[**-C --compiled-rules**](#C)

RULES\_FILE contains rules already compiled with yarac.

[**-c --count**](#c)

Print number of matches only.

[**-d --define=identifier=value**](#d)

Define an external variable. This option can be used multiple times.

[**--fail-on-warnings**](#fail-on-warnings)

Treat warnings as errors. Has no effect if used with **--no-warnings.**

[**-f --fast-scan**](#f)

Speeds up scanning by searching only for the first occurrence of each pattern.

[**-i identifier --identifier=identifier**](#i)

Print rules named *identifier* and ignore the rest. This option can be used multiple times.

[**--max-process-memory-chunk=size**](#max-process-memory-chunk=)

While scanning process memory read data in chunks of the given *size* in bytes.

[**-l number --max-rules=number**](#l)

Abort scanning after a *number* of rules matched.

[**--max-strings-per-rule=number**](#max-strings-per-rule=)

Set maximum number of strings per rule (default=10000)

[**-x --module-data=module=file**](#x)

Pass file's content as extra data to module. This option can be used multiple times.

[**-n --negate**](#n)

Print rules that doesn't apply (negate).

[**-w --no-warnings**](#w)

Disable warnings.

[**-m --print-meta**](#m)

Print metadata associated to the rule.

[**-D --print-module-data**](#D)

Print module data.

[**-M --module-names**](#M)

show module names

[**-e --print-namespace**](#e)

Print namespace associated to the rule.

[**-S --print-stats**](#S)

Print rules' statistics.

[**-s --print-strings**](#s)

Print strings found in the file.

[**-L --print-string-length**](#L)

Print length of strings found in the file.

[**-X --print-xor-key**](#X)

Print xor key of matched strings.

[**-g --print-tags**](#g)

Print the tags associated to the rule.

[**-r --recursive**](#r)

Scan files in directories recursively. It follows symlinks.

[**--scan-list**](#scan-list)

Scan files listed in FILE, one per line.

[**-z size --skip-larger=size**](#z)

Skip files larger than the given *size* in bytes when scanning a directory.

[**-k slots --stack-size=slots**](#k)

Set maximum stack size to the specified number of *slots.*

[**--strict-escape**](#strict-escape)

Print warnings if rules contain ambiguous escape statements.

[**-t tag --tag=tag**](#t)

Print rules tagged as *tag* and ignore the rest. This option can be used multiple times.

[**-p number --threads=number**](#p)

Use the specified *number* of threads to scan a directory.

[**-a seconds --timeout=seconds**](#a)

Abort scanning after a number of *seconds* has elapsed.

[**-v --version**](#v)

Show version information.

# [EXAMPLES](#EXAMPLES)

$ yara /foo/bar/rules .

Apply rules on */foo/bar/rules* to all files on current directory. Subdirectories are not scanned.

$ yara -t Packer -t Compiler /foo/bar/rules bazfile

Apply rules on */foo/bar/rules* to *bazfile.* Only reports rules tagged as *Packer* or *Compiler.*

$ cat /foo/bar/rules | yara -r /foo

Scan all files in the */foo* directory and its subdirectories. Rules are read from standard input.

$ yara -d mybool=true -d myint=5 -d mystring="my string" /foo/bar/rules bazfile

Defines three external variables *mybool* *myint* and *mystring.*

$ yara -x cuckoo=cuckoo\_json\_report /foo/bar/rules bazfile

Apply rules on */foo/bar/rules* to *bazfile* while passing the content of *cuckoo\_json\_report* to the cuckoo module.

# [AUTHOR](#AUTHOR)

Victor M. Alvarez <plusvic@gmail.com>;<vmalvarez@virustotal.com>

September 22, 2008 Victor M. Alvarez

---

Document: yara(1) from yara 4.5.5-r4 (Chainguard OS)
Source: https://github.com/VirusTotal/yara