yara-authoring

name	yara-authoring
description	YARA-X detection rule authoring with expert judgment, linting, atom analysis, and best practices. Teaches how to think like an expert YARA author for malware detection, threat hunting, and indicator-of-compromise identification using YARA-X (the Rust-based successor to legacy YARA).
version	1.1.0
model	sonnet
invoked_by	both
user_invocable	true
tools	["Read","Write","Bash","Glob","Grep"]
args	<sample-path|hash|description> [--format yara-x|legacy] [--lint] [--atoms]
agents	["reverse-engineer","security-architect","penetration-tester"]
category	security
best_practices	["Write rules targeting YARA-X syntax and features by default","Always include metadata fields (author, date, description, reference, hash)","Use atom analysis to verify rules have efficient matching atoms","Lint rules before deployment to catch common errors","Prefer specific byte patterns over broad wildcards to reduce false positives"]
error_handling	graceful
streaming	supported
verified	true
lastVerifiedAt	"2026-03-01T00:00:00.000Z"
source	builtin
trust_score	100
provenance_sha	4f99f4c1be688483

YARA Authoring Skill

Expert YARA-X detection rule authoring skill adapted from Trail of Bits security research methodology. Guides authoring of high-quality YARA-X rules for malware detection, threat hunting, and IOC identification. Emphasizes expert judgment, atom efficiency analysis, linting, and the YARA-X Rust-based toolchain. - YARA-X rule authoring with expert-level patterns - YARA-X syntax and feature usage (Rust-based successor to legacy YARA) - Rule metadata standards (author, date, description, reference, hash) - Atom analysis for matching efficiency verification - Rule linting and validation - String pattern design (hex, text, regex) - Condition logic optimization - False positive rate minimization - Module usage (PE, ELF, Mach-O, dotnet, math, hash) - Rule set organization and naming conventions - Legacy YARA to YARA-X migration guidance

Overview

This skill implements Trail of Bits' YARA authoring methodology for the agent-studio framework. YARA-X is the Rust-based successor to legacy YARA, offering improved performance, safety, and new features. This skill teaches you to think and act like an expert YARA author, producing detection rules that are precise, efficient, and maintainable.

Source repository: https://github.com/trailofbits/skills License: CC-BY-SA-4.0 Target: YARA-X (with legacy YARA compatibility guidance)

When to Use

• When creating detection rules for malware samples
• When building threat hunting rules for IOC identification
• When converting legacy YARA rules to YARA-X format
• When optimizing existing rules for performance and accuracy
• When reviewing YARA rules for quality and false positive rates
• When building rule sets for automated scanning pipelines

Iron Laws

1. EVERY RULE MUST HAVE EFFICIENT ATOMS AND PASS LINTING — a rule without efficient atoms degrades scanner performance across the entire rule set; always run yr check and yr debug atoms before deployment.
2. NEVER write rules without testing against both positive and negative samples — false positives on clean files are as harmful as missed detections; validate FP rate before deploying.
3. ALWAYS include complete metadata (author, date, description, reference, hash) — rules without metadata are unauditable and unmaintainable in enterprise rule sets.
4. NEVER use single-byte atoms or patterns starting with common bytes (0x00, 0xFF, 0x90) — these generate massive false positive rates and degrade the entire YARA scanning pipeline.
5. ALWAYS use YARA-X toolchain (yr) by default — legacy / tooling lacks memory safety, performance optimizations, and modern module support; use YARA-X unless backward compatibility is explicitly required.