yara

参考文档

• Getting started
• Writing YARA rules
  • Comments
  • Strings
  • Conditions
  • More about rules
  • Using modules
  • Undefined values
  • External variables
  • Including files
• Modules
• Writing your own modules
• Running YARA from the command-line
• Using YARA from Python
• The C API

非常棒的各类yara规则

https://github.com/InQuest/awesome-yara

code

GitHub - VirusTotal/yara at v4.2.2