Yara Authoring

YARA-X Authoring Plugin

A behavior-driven skill for authoring high-quality YARA-X detection rules, teaching you to think and act like an expert YARA author.

**YARA-X Focus:** This skill targets [YARA-X](https://virustotal.github.io/yara-x/), the Rust-based successor to legacy YARA. YARA-X powers VirusTotal's Livehunt/Retrohunt production systems and is 5-10x faster for regex-heavy rules. Legacy YARA (C implementation) is in maintenance mode.

Philosophy

This skill doesn't dump YARA syntax at you. Instead, it teaches:

• Decision trees for common judgment calls (Is this string good enough? When to abandon an approach?)
• Expert heuristics (mutex names are gold, API names are garbage)
• Rationalizations to reject (the shortcuts that cause production failures)

An expert uses 5 tools: yarGen, FLOSS, `yr` CLI, signature-base, YARA-CI. Everything else is noise.

Installation

YARA-X CLI

# macOS
brew install yara-x

# Or from source
cargo install yara-x

# Verify installation
yr --version

Python Package (for scripts)

pip install yara-x
# or with uv
uv pip install yara-x

Plugin

Add this plugin to your Claude Code configuration:

claude mcp add-plugin /path/to/yara-authoring

Skills

yara-rule-authoring

Guides authoring of YARA-X rules for malware detection with expert judgment.

**Covers:**

• Decision trees for string quality, when to abandon approaches, debugging FPs
• Expert heuristics from experienced YARA authors
• Rationalizations to reject (common shortcuts that fail)
• Naming conventions (CATEGORY_PLATFORM_FAMILY_DATE format)
• Performance optimization (atom quality, short-circuit conditions)
• Testing workflow (goodware corpus validation)
• YARA-X migration guide for converting legacy rules
• Chrome extension analysis with crx module
• Android DEX analysis with dex module

**Triggers:** YARA, YARA-X, malware detection, threat hunting, IOC, signature

Scripts

...