yara-rule-authoring

# YARA-X Rule Authoring Write detection rules that catch malware without drowning in false positives. > **This skill targets YARA-X**, the Rust-based successor to legacy YARA. YARA-X powers VirusTotal's production systems and is the recommended implementation. See [Migrating from Legacy YARA](#migrating-from-legacy-yara) if you have existing rules. ## Core Principles 1. **Strings must generate good atoms** — YARA extracts 4-byte subsequences for fast matching. Strings with repeated bytes, common sequences, or under 4 bytes force slow bytecode verification on too many files. 2. **Target specific families, not categories** — "Detects ransomware" catches everything and nothing. "Detects LockBit 3.0 configuration extraction routine" catches what you want. 3. **Test against goodware before deployment** — A rule that fires on Windows system files is useless. Validate against VirusTotal's goodware corpus or your own clean file set. 4. **Short-circuit with cheap checks first** — Put `filesize < 10MB and uint16(0) == 0x5A4D` before expensive string searches or module calls. 5. **Metadata is documentation** — Future you (and your team) need to know what this catches, why, and where the sample came from. ## When to Use - Writing new YARA-X rules for malware detection - Reviewing existing rules for quality or performance issues - Optimizing slow-running rulesets - Converting IOCs or threat intel into detection signatures - Debugging false positive issues - Preparing rules for p...