yaraQA: YARA rule analyzer
YARA rule Analyzer to improve rule quality and performance
YARA rules can be syntactically correct but still dysfunctional. yaraQA tries to find and report these issues to the author or maintainer of a YARA rule set.
The issues yaraQA tries to detect are e.g.:
- rules that are syntactically correct but never match due to errors in the condition (e.g. rule with one string and 2 of them in the condition)
- rules that use string and modifier combinations that are probably wrong (e.g. $ = “\\Debug\\” fullword)
- performance issues caused by short atoms, repeating characters, or loops (e.g. $ = “AA”; can be excluded from the analysis using –ignore-performance)
git clone https://github.com/Neo23x0/yaraQA.git
pip install -r requirements.txt
python3 yaraQA.py -d ./test/
Suppress all performance issues and only show detection / logic issues.
python3 yaraQA.py -d ./test/ –ignore-performance
Suppress all issues of informational character
python3 yaraQA.py -d ./test/ -level 2
Use a baseline to only see new issues (not the ones that you’ve already reviewed). The baseline file is an old JSON output of a reviewed state.
python3 yaraQA.py -d ./test/ -b yaraQA-reviewed-issues.json
Copyright (C) 2023 Neo23x0