# Installer yara avec Homebrew, apk, chocolatey, apt, dnf, MacPorts, Nix, pacman, zypper, scoop, winget
Consultez les chemins d'installation, exécutables, métadonnées et notes de sécurité de yara pour les workflows d'agents IA.
## installation
```sh
sudo av install brew:yara
```
Commandes d'installation supplémentaires:
### macOS
- Homebrew (100%):
```sh
brew install yara
```
Preuve: local Homebrew formula metadata
- MacPorts (94%):
```sh
sudo port install yara
```
Preuve: MacPorts ports tree: security/yara/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1
### Linux
- apk (92%):
```sh
sudo apk add yara
```
Preuve: Alpine Linux edge package indexes: yara from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz
- Debian apt (92%):
```sh
sudo apt install yara
```
Preuve: Debian stable package indexes: yara from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz
- dnf (92%):
```sh
sudo dnf install yara
```
Preuve: Fedora Rawhide package metadata: yara from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst
- Nix (92%):
```sh
nix profile install nixpkgs#yara
```
Preuve: nixpkgs package indexes: pkgs/by-name/ya/yara/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
- pacman (92%):
```sh
sudo pacman -S yara
```
Preuve: Arch Linux sync databases: yara from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz
- zypper (92%):
```sh
sudo zypper install yara
```
Preuve: openSUSE Tumbleweed package metadata: yara from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst
### Windows
- Chocolatey (92%):
```sh
choco install yara
```
Preuve: Chocolatey community package catalog: yara from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','wsl-ubuntu-2204'
- Scoop (92%):
```sh
scoop install main/yara
```
Preuve: Scoop official bucket manifest trees: bucket/yara.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1
- winget (92%):
```sh
winget install --id VirusTotal.YARA -e
```
Preuve: Windows Package Manager source index: VirusTotal.YARA from https://cdn.winget.microsoft.com/cache/source.msix
## Faits du paquet
- **Clé du paquet:** brew:yara
- **Gestionnaire de paquets:** Homebrew
- **Version:** 4.5.8
- **Résumé source:** Malware identification and classification tool
- **Page d'accueil:**
- **Dépôt:**
- **Dernière mise à jour:** 2026-07-28T10:28:26Z
- **Généré:** 2026-08-03T19:37:03+00:00
## exécutables
- yara (alias)
- yarac (alias)
## Comportement d'installation
- Bouteille: non disponible
## Version et fraîcheur
- page générée: 2026-08-03
- version du gestionnaire: 4.5.8
## Historique du projet et usages
YARA is VirusTotal's rule-based pattern-matching tool for malware researchers and incident responders. It lets analysts describe malware families, file traits, or other detectable artifacts with strings, byte patterns, regular expressions, metadata, and boolean conditions, then scan files, directories, or process memory.
### Historique du projet
YARA's manual page dates the `yara` command to 2008-09-22 and names Victor M. Alvarez as author. The current VirusTotal GitHub repository was created on 2012-12-06, and the first GitHub release returned by the API is YARA v2.0.0 in August 2014.
The project became the pattern-matching 'Swiss knife' for malware researchers by keeping a compact rule language while adding modules, compiled rules, Python bindings, and multi-platform support. The README and official docs describe use from the command line and from Python scripts through yara-python.
In the mid-2020s, YARA's history shifted from active feature growth to maintenance. The README now points to the YARA-X stability announcement and marks the classic YARA project as maintenance mode, with new feature work moving to the Rust rewrite.
### Historique d'adoption
YARA's adoption is unusually broad for a command-line security tool. The upstream README maintains a long 'Who's using YARA' list that includes antivirus vendors, incident-response products, sandboxes, intelligence platforms, reverse-engineering tools, and VirusTotal itself.
Its practical appeal is portability of detection logic. A YARA rule can move from a researcher's laptop to a malware sandbox, a retrohunt service, an endpoint product, or a CI check for detection rules. That made it a common exchange format for malware-family knowledge, not just a local scanner.
### Modes d'utilisation
Users write one or more rule files, compile them with `yarac` when useful, and run `yara` against files, directories, or PIDs. Options support namespaces, external variables, module data, metadata printing, string-match output, fast scans, warnings control, and scanning process memory in chunks.
In security operations, YARA is used for malware triage, hunting known families and variants, validating rule collections, retroactive corpus searches, sandbox classification, and embedding detection logic into larger analysis systems through libyara or yara-python.
### Pourquoi les passionnés de paquets s'y intéressent
YARA is one of the canonical examples of a domain-specific language packaged as a Unix tool. The package matters because it ships not just an executable, but a rule language, compiler, C library, Python ecosystem, and compatibility target for thousands of shared security rules.
The YARA-to-YARA-X transition is also important packaging history: a widely deployed security utility entered maintenance mode while its official successor was distributed beside it, letting package managers carry both the stable incumbent and the future implementation.
### Chronologie
- 2008-09-22: YARA manual page date identifies the command and Victor M. Alvarez as author.
- 2012-12-06: VirusTotal/yara repository is created on GitHub.
- 2014-08-26: YARA v2.0.0 appears as the earliest GitHub release returned by the releases API.
- 2024-02-21: VirusTotal announces future feature work will focus on YARA-X while YARA continues maintenance.
- 2025-06-04: YARA-X 1.0.0 announcement states original YARA enters maintenance mode.
- 2025-10-30: YARA v4.5.5 is published as a maintenance release.
### Related projects
- YARA-X is the official Rust rewrite and future development focus.
- yara-python exposes YARA scanning and compilation features to Python programs.
- YARA-CI, awesome-yara, and rule repositories such as Elastic protections-artifacts are part of the wider YARA rule ecosystem.
### Sources
-
-
-
-
-
-
-
-
## Notes de sécurité
narrow executable package without higher-risk signals.
- **Risque Geiger:** vert / faible
- narrow executable package without higher-risk signals
## Autres enregistrements de gestionnaires de paquets
- Debian apt - libyara-dev - 4.5.2-1: normalized package name match | Debian stable package indexes: libyara-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | YARA development libraries and headers | https://virustotal.github.io/yara/
- Debian apt - libyara10 - 4.5.2-1: normalized package name match | Debian stable package indexes: libyara10 from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | YARA shared library | https://virustotal.github.io/yara/
- Debian apt - yara - 4.5.2-1: normalized package name match | Debian stable package indexes: yara from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Pattern matching swiss knife for malware researchers | https://virustotal.github.io/yara/
- Debian apt - yara-doc - 4.5.2-1: normalized package name match | Debian stable package indexes: yara-doc from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | HTML documentation for YARA | https://virustotal.github.io/yara/
- Nix - yara: normalized package name match | nixpkgs package indexes: pkgs/by-name/ya/yara/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
- Ubuntu apt - libyara-dev - 4.5.0-1build2: normalized package name match | Ubuntu 24.04 LTS package indexes: libyara-dev from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | YARA development libraries and headers | https://virustotal.github.io/yara/
- Ubuntu apt - libyara10 - 4.5.0-1build2: normalized package name match | Ubuntu 24.04 LTS package indexes: libyara10 from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | YARA shared library | https://virustotal.github.io/yara/
- Ubuntu apt - yara - 4.5.0-1build2: normalized package name match | Ubuntu 24.04 LTS package indexes: yara from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | Pattern matching swiss knife for malware researchers | https://virustotal.github.io/yara/
- Ubuntu apt - yara-doc - 4.5.0-1build2: normalized package name match | Ubuntu 24.04 LTS package indexes: yara-doc from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | HTML documentation for YARA | https://virustotal.github.io/yara/
- apk - yara - 4.5.8-r0: normalized package name match | Alpine Linux edge package indexes: yara from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Pattern matching swiss knife for malware researchers | https://virustotal.github.io/yara/
- apk - yara-dev - 4.5.8-r0: normalized package name match | Alpine Linux edge package indexes: yara-dev from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Pattern matching swiss knife for malware researchers (development files) | https://virustotal.github.io/yara/
- apk - yara-doc - 4.5.8-r0: normalized package name match | Alpine Linux edge package indexes: yara-doc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Pattern matching swiss knife for malware researchers (documentation) | https://virustotal.github.io/yara/
- dnf - yara - 4.5.7-6.fc45: normalized package name match | Fedora Rawhide package metadata: yara from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst | Pattern matching Swiss knife for malware researchers | https://VirusTotal.github.io/yara/
- dnf - yara-devel - 4.5.7-6.fc45: normalized package name match | Fedora Rawhide package metadata: yara-devel from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst | Development files for yara | https://VirusTotal.github.io/yara/
- dnf - yara-doc - 4.5.7-6.fc45: normalized package name match | Fedora Rawhide package metadata: yara-doc from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst | Documentation for yara | https://VirusTotal.github.io/yara/
- pacman - yara - 4.5.7-1: normalized package name match | Arch Linux sync databases: yara from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Tool aimed at helping malware researchers to identify and classify malware samples | https://github.com/VirusTotal/yara
## Combined YAML source
View the package source record on GitHub. [combined/yara.yml](https://github.com/mxcl/pkgdb/blob/main/combined/yara.yml)
## Sources
- pkg.so package database
- Geiger risk classifier
- curated package history
- pkgdb category and tag curation
- external package-manager database matches
- cross-ecosystem install command graph