<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: building-yara-rule-development
description: >-
  Author, test, optimize, and manage YARA rules for malware detection, threat hunting, and file classification across endpoints and sandbox environments.
domain: cybersecurity
subdomain: detection-engineering
tags:
  - yara-rules
  - malware-detection
  - threat-hunting
  - file-classification
  - pattern-matching
  - binary-analysis
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1587.001"]
---

# Building Yara Rule Development

## Overview

YARA rule development enables analysts to identify and classify malware samples,
suspicious files, and threat artifacts using pattern-matching signatures.
Covers string patterns, conditions, modules, and performance optimization.

## Prerequisites

| Requirement | Purpose |
|---|---|
| yara | `pip install yara-python` |
| yara CLI | YARA binary for rule testing |
| Sample corpus | Benign and malicious file samples for testing |

## Key Concepts

### Advanced YARA Patterns

```yara
rule APT_Backdoor_Cobalt_Strike_Beacon
{
    meta:
        description = "Detects Cobalt Strike beacon in memory or on disk"
        author = "defconxt"
        reference = "https://attack.mitre.org/software/S0154/"
        severity = "critical"
        tlp = "white"
    strings:
        $magic = { 4D 5A }
        $str1 = "%s as %s\\%s: %d" ascii
        $str2 = "beacon.dll" ascii nocase
        $config = { 00 01 00 01 00 02 ?? ?? 00 02 00 01 00 02 ?? ?? }
    condition:
        $magic at 0 and (2 of ($str*)) or $config
}
```

## Workflow

1. **Identify threat** — Define malware family or artifact to detect
2. **Collect samples** — Gather known-good and known-bad specimens
3. **Extract patterns** — Identify unique strings, byte sequences, structures
4. **Author rule** — Write YARA rule with metadata and conditions
5. **Test accuracy** — Validate against sample corpus for TP/FP rates
6. **Optimize performance** — Reduce scan time with anchored strings and short-circuit conditions
7. **Deploy and maintain** — Push to scanning infrastructure, track rule quality

## Detection

```yaml
title: Yara Rule Development Detection
id: 11ae8548-03c1-4192-bda5-f8df32b4494f
status: experimental
description: Detects suspicious activity related to building yara rule development techniques in detection engineering context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*building*yara*"
  condition: selection
level: medium
tags:
  - attack.t1587.001
  - attack.defense_evasion
falsepositives:
  - Detection rule testing in staging SIEM environment
```

## Verification

| Check | Method |
|---|---|
| Workflow completed | All steps executed and documented |
| Output validated | Results match expected format and content |
| Quality assured | Peer review or automated validation passed |

## References

- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)
- [MITRE ATT&CK](https://attack.mitre.org/)
