YARA is a pattern matching engine that lets you describe a malware family as a set of rules and then automatically spot the files that match it. It is published by VirusTotal under the three-clause BSD license, and Victor M. Alvarez, one of its original authors, still signs the latest releases. The copyright notice in the repository traces the project back to 2007.
Its status changed in 2025. On June 4 that year, VirusTotal announced YARA-X 1.0, a full rewrite in Rust, and moved the original YARA into maintenance mode. It now receives only critical bug fixes and security patches, with no new features, and all future development happens in YARA-X. The publisher adds that YARA will stay available and maintained for the foreseeable future to give users time to migrate.
What YARA is for
A YARA rule combines two things: a list of strings to look for, which can be plain text, hexadecimal byte sequences or regular expressions, and a boolean condition that decides when the rule fires. A rule can require three out of five distinctive strings, cap the file size or check that a string appears at a specific offset. The yara command line tool applies rules to files, whole directories or a running process’s memory, while yarac compiles them ahead of time to speed up repeated scans.
Modules make conditions richer by exposing the internal structure of files. The PE module gives access to a Windows executable’s imports, sections and signature, and others cover ELF and .NET binaries, LNK shortcuts, cryptographic hashes and entropy, which often betrays encrypted or packed content. A C library and the yara-python extension let developers embed the engine in their own programs.
That flexibility explains why YARA shows up in so many tools. Volatility, which is also part of our software library, uses it to search memory images, and Autopsy has a module that applies YARA rules to the files in a case. The project README lists around ninety organizations that use it, including ESET, Kaspersky, Trend Micro, Cisco Talos and Elastic Security.
With YARA-X now available, any new project faces a choice. According to its documentation, YARA-X handles regular expressions and complex hex patterns much faster and produces clearer error messages, but it is not a drop-in replacement and cannot yet scan process memory.
Who is it for?
YARA is aimed at malware analysts, threat intelligence teams, security operations centers and incident responders, who trade rules to share what they find. Security vendors also build it into their own products.
It is not an antivirus. It offers no real-time protection, and it is only as good as the rules it is given, which you need to write yourself or obtain from trustworthy sources. There is no graphical interface. Existing deployments and rule sets keep working, but a team starting from scratch today should look at YARA-X, since that is where all new features will land.
Download YARA safely
Source code and releases are on GitHub in the VirusTotal/yara repository. The latest version, 4.5.8 from July 28, 2026, fixes a batch of memory safety bugs in the PE, .NET, ELF, Mach-O and DEX parsers. It ships as source code only: the most recent ready-made Windows binaries, in 32-bit and 64-bit builds, come with version 4.5.5 from October 2025. For Linux and macOS, the documentation explains how to compile with the usual GNU build tools and how to install through Homebrew or vcpkg.
YARA is completely free, with no paid edition. The documentation points out that the Scoop and Chocolatey packages for Windows are not maintained by the project’s authors. For a tool whose job is to inspect potentially dangerous files, it makes sense to get binaries from the GitHub releases page or build them yourself rather than trust an executable picked up elsewhere.
Frequently asked questions
Has YARA been abandoned?
No, but it has been in maintenance mode since June 2025. VirusTotal still ships fixes, as version 4.5.8 from July 2026 shows, but no new features are planned. New work goes into YARA-X.
Will my YARA rules work with YARA-X?
Mostly, since YARA-X uses the same rule language, but the publisher warns that it is not a drop-in replacement. The YARA-X documentation has a page on behavioral differences that is worth reading before moving a rule set into production.
Can I use YARA from Python?
Yes, through the yara-python extension, which is distributed separately in its own GitHub repository. It lets a script compile rules and apply them to files or to data held in memory.
