Install yara with Homebrew, apk, chocolatey, apt, dnf, MacPorts, Nix, pacman, zypper, scoop, winget

Project links

• Homepage
• Repository

Commands and aliases

• yara
• yarac

Project history

YARA's manual page dates the `yara` command to 2008-09-22 and names Victor M. Alvarez as author. The current VirusTotal GitHub repository was created on 2012-12-06, and the first GitHub release returned by the API is YARA v2.0.0 in August 2014.

The project became the pattern-matching 'Swiss knife' for malware researchers by keeping a compact rule language while adding modules, compiled rules, Python bindings, and multi-platform support. The README and official docs describe use from the command line and from Python scripts through yara-python.

In the mid-2020s, YARA's history shifted from active feature growth to maintenance. The README now points to the YARA-X stability announcement and marks the classic YARA project as maintenance mode, with new feature work moving to the Rust rewrite.

Adoption history

YARA's adoption is unusually broad for a command-line security tool. The upstream README maintains a long 'Who's using YARA' list that includes antivirus vendors, incident-response products, sandboxes, intelligence platforms, reverse-engineering tools, and VirusTotal itself.

Its practical appeal is portability of detection logic. A YARA rule can move from a researcher's laptop to a malware sandbox, a retrohunt service, an endpoint product, or a CI check for detection rules. That made it a common exchange format for malware-family knowledge, not just a local scanner.

How it is used

Users write one or more rule files, compile them with `yarac` when useful, and run `yara` against files, directories, or PIDs. Options support namespaces, external variables, module data, metadata printing, string-match output, fast scans, warnings control, and scanning process memory in chunks.

In security operations, YARA is used for malware triage, hunting known families and variants, validating rule collections, retroactive corpus searches, sandbox classification, and embedding detection logic into larger analysis systems through libyara or yara-python.

Why package nerds care

YARA is one of the canonical examples of a domain-specific language packaged as a Unix tool. The package matters because it ships not just an executable, but a rule language, compiler, C library, Python ecosystem, and compatibility target for thousands of shared security rules.

The YARA-to-YARA-X transition is also important packaging history: a widely deployed security utility entered maintenance mode while its official successor was distributed beside it, letting package managers carry both the stable incumbent and the future implementation.

Timeline

• 2008-09-22: YARA manual page date identifies the command and Victor M. Alvarez as author.
• 2012-12-06: VirusTotal/yara repository is created on GitHub.
• 2014-08-26: YARA v2.0.0 appears as the earliest GitHub release returned by the releases API.
• 2024-02-21: VirusTotal announces future feature work will focus on YARA-X while YARA continues maintenance.
• 2025-06-04: YARA-X 1.0.0 announcement states original YARA enters maintenance mode.
• 2025-10-30: YARA v4.5.5 is published as a maintenance release.

Related projects

• YARA-X is the official Rust rewrite and future development focus.
• yara-python exposes YARA scanning and compilation features to Python programs.
• YARA-CI, awesome-yara, and rule repositories such as Elastic protections-artifacts are part of the wider YARA rule ecosystem.

Sources

• https://api.github.com/repos/VirusTotal/yara
• https://api.github.com/repos/VirusTotal/yara/releases?per_page=100
• https://github.com/VirusTotal/yara
• https://raw.githubusercontent.com/VirusTotal/yara/master/README.md
• https://raw.githubusercontent.com/VirusTotal/yara/master/yara.man
• https://virustotal.github.io/yara-x/blog/yara-is-dead-long-live-yara-x/
• https://virustotal.github.io/yara-x/blog/yara-x-is-stable/
• https://yara.readthedocs.io/en/stable/