Works with the AI tools you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+22 more

    YARA Rule Generator

    1

    Automated YARA rule generation, linting, and scanning for malware detection and incident response.

    $4.99

    Secure checkout via Stripe

    30-day refund guarantee

    Converts to your local currency at checkout

    Security scanned
    YARA Rule Generator

    YARA Rule Generator

    Example session with this skill installed

    I have a malware sample in ./samples/malware.exe. Help me write a YARA rule for it that filters out strings found in /usr/bin and lints the final output.

    • Read your context and instructions
    • Compiled the yara rule generator

    I have analyzed the sample and cross-referenced it against the goodware in /usr/bin. I extracted distinctive PDB paths and unique obfuscation strings while ensuring proper PE header anchoring and filesize constraints.

    YARA Rule: Trojan_Win32_Generic_Loader

    rule Trojan_Win32_Generic_Loader
{
    meta:
        description = "Detects generic loader variant characterized by specific PDB path and mutex strings"
        author = "Security Ops"
        date = "2023-10-27"
        hash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
        status = "experimental"

    strings:
        // PDB Path - High Score
        $pdb = "C:\\Users\\Dev\\Documents\\Visual Studio 2019\\Projects\\Loader\\Release\\payload.pdb" ascii
        
        // Obfuscated strings found in sample, not in goodware
        $s1 = "Global\\{7A8D2F31-9E4B-4C2A-BD1F-52319A0C}" ascii wide
        $s2 = "cmd.exe /c start /B \"\" \"C:\\Windows\\Temp\\" ascii wide
        $s3 = "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" ascii
        
        // Encrypted configuration marker
        $hex_marker = { 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF }

    condition:
        (uint16(0) == 0x5A4D) and 
        (filesize < 500KB) and 
        ($pdb or 2 of ($s*)) and
        $hex_marker
}

    Next steps

    1. Run python3 scripts/yara_lint.py rules/Trojan_Win32_Generic_Loader.yar to verify the rule against performance standards.
    2. Execute python3 scripts/yara_scan.py rules/ ./samples/ --json results.json to confirm the rule hits your target sample.
    3. Test the rule against your full goodware repository to ensure zero false positives before deployment.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Writing production-grade YARA rules is a balancing act between detection efficacy and performance-draining false positives. Manually extracting strings from malware samples while filtering out common goodware artifacts is slow and error-prone. This skill automates the signature development lifecycle, from initial string extraction to linting and scanning.

    What it does

    • Automated rule generation extracts ASCII and UTF-16LE strings from malware samples while excluding those found in a goodware corpus.
    • Heuristic scoring prioritizes high-value indicators like PDB paths, mutexes, and unique format strings over common English words.
    • Built-in linting catches syntax errors, unused strings, and performance bottlenecks without requiring a YARA installation.
    • Quality enforcement flags risky patterns like unbounded regex, missing filesize bounds, and absent magic-byte anchors.
    • Scan wrapping provides a structured interface for testing rules against local directories using yara-python.

    How it works

    1. Analyze samples by running the generator script against a directory of malicious files and a reference goodware set.
    2. Refine the output by reviewing the scored strings and selecting structural indicators for the rule condition.
    3. Run the linter to ensure the rule meets metadata standards and avoids performance-heavy regex or short-string matches.
    4. Execute test scans to verify detection across samples and confirm zero hits against a known-clean baseline.

    Frameworks & tools

    This skill uses Python for automation scripts and requires yara-python for scanning capabilities. It generates standard YARA rules compatible with version 3.x and 4.x engines.

    Why this beats prompting it yourself

    Generic AI prompts often produce rules that are too broad or lack the necessary filesize and uint16(0) anchors required for production performance. This skill enforces specific logic, like automated goodware filtering and nibble-count verification, that manual prompting typically ignores.

    Use cases

    • Generating signatures for a new malware family based on a small set of PE samples.
    • Auditing a repository of legacy rules for performance risks and missing metadata.
    • Rapidly creating webshell detection signatures for incident response triage.
    • Testing local signature sets against system binaries to minimize false positive rates.

    Known limitations

    Scanning requires yara-python to be installed in the environment. The automated generator focuses on string-based signatures and does not perform deep behavioral or code-graph analysis.

    How to use

    Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    30-day refund

    Not a fit? Get your money back

    Trust & safety

    Security scanned

    Verified clean 1 day ago

    • Passed all security checks, Safe to install

    Listed1 day ago
    Updatedtoday

    What's inside

    Frequently Asked Questions