A dispatch from the woods. In defense of ASCII, quiet computers, and telling your family you made it home.

Implement SIMD-accelerated masked literal matching (#691). Improve atom extraction heuristics for better performance (#690, 1e14f60). Improve scan performance by applying file size and file header ...

Distinct Russian clusters have been conducting phishing activity focused on Application Specific Passwords (ASP), OAuth flows, and malware delivery. All of these operations seem focused on account com...

Introducing the new unintended_pattern_in_set compiler warning in YARA-X to catch overlapping variable prefixes and pattern set collisions.

Distinct Russian clusters have been conducting phishing activity focused on Application Specific Passwords (ASP), OAuth flows, and malware delivery. All of these operations seem focused on account com...

This fixes the "private" modifier on hex strings so they are properly hidden from output and also fixes it so the modifier is properly displayed in both AST and CST representations. This ...

Analysis of a backdoor, STOCKSTAY, that has been continually developed and deployed by the Russia-linked threat actor Turla.

Add missing machine architecture types to pe module (#687). Add warning for single-byte patterns (71baa67). Add warning for duplicate patterns in a rule (9061803). Small optimization when generatin...

Multiple performance improvements (#623, #624, #626, #627, #629, #631, #632, #635, #649, #654). Implement constant folding for bitwise operations (#634). Allow specifying context size for matches (...

Add full support for WASM. The whole yara-x create now can be built for WASM (#583, #588, #598). New playground at https://virustotal.github.io/yara-x/playground/ (#601). The yr check command now n...

https://www.mandiant.com/blog/tracking-malware-import-hashing/ Mandiant's imphash convention requires the following: Resolving ordinals to function names when they appear Converting both DLL names ...

When the tag linter comes across multiple errors only the first one is returned. This is due to an oversight in the API where we can only return a single error, not a vector of errors. I realize th...

ALT: two men are standing next to each other and one of them is wearing a shirt that says nuts

ALT: a man in a suit and tie sits at a desk with the words " i don 't even really work here " above him

The defense sector faces a relentless barrage of operations conducted by state-sponsored actors and criminal groups.

Add crx and dex modules to Python invoke API (#534). Add Python API for specifying the metadata that should be passed to modules (6bebe34): Output filenames that needs reformatting when using yr fm...

Improvements in the parser to produce better Concrete Syntax Trees (#531, c46b3bd). BUGFIX: avoid panic when parsing some regular expressions (136ab9f).

Make the parser stricter (#502). Implement dex module (#458). Implement C api console log (#515). Implement permhash for the crx module (#510). Implement the imports() method for the Rules object i...

The imphash implementation always returns a lowercase md5. This commit switches the type of the returned value so that it can be used to generate warnings. Warnings are now generated if you use an ...

New yr fix warnings command (#493). Generate more efficient WASM code for some expressions, reducing the size of compiled rules (5efc214, a865681). Improve the API for traversing the AST in DFS ord...

This branch adds a "deps" command that generates dependency information for a set of rules. It walks the AST looking for identifiers of rules, modules and unknown identifiers (hopefully e...

Experimenting with YARA and Rust. Contribute to wxsBSD/yara-x development by creating an account on GitHub.

Add function for scanning files by path to the C and Go APIs (32bac10). Add version number to the Rust API (bdb53e8, #469). Add osabi field to elf module (afa0960). Avoid verifying patterns when th...

Russia state-sponsored COLDRIVER started using new malware immediately following a May public disclosure of their activity.

Documents the differences between YARA-X and YARA.