{"id":17913006,"url":"https://github.com/neo23x0/yaraqa","last_synced_at":"2025-04-06T22:07:05.219Z","repository":{"id":150203435,"uuid":"584709367","full_name":"Neo23x0/yaraQA","owner":"Neo23x0","description":"YARA rule analyzer to improve rule quality and performance","archived":false,"fork":false,"pushed_at":"2024-12-23T08:46:38.000Z","size":8550,"stargazers_count":98,"open_issues_count":1,"forks_count":6,"subscribers_count":6,"default_branch":"main","last_synced_at":"2025-04-04T14:40:23.776Z","etag":null,"topics":["detection","malware-detection","malware-research","signatures","yara"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Neo23x0.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-01-03T10:08:49.000Z","updated_at":"2025-03-31T20:27:44.000Z","dependencies_parsed_at":null,"dependency_job_id":"50a61ab3-50aa-44fc-9d9a-f5a60f78a49c","html_url":"https://github.com/Neo23x0/yaraQA","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Neo23x0%2FyaraQA","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Neo23x0%2FyaraQA/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Neo23x0%2FyaraQA/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Neo23x0%2FyaraQA/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Neo23x0","download_url":"https://codeload.github.com/Neo23x0/yaraQA/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247557767,"owners_count":20958047,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["detection","malware-detection","malware-research","signatures","yara"],"created_at":"2024-10-28T19:49:10.465Z","updated_at":"2025-04-06T22:07:05.200Z","avatar_url":"https://github.com/Neo23x0.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# yaraQA\nYARA rule Analyzer to improve rule quality and performance\n\n## Why?\n\nYARA rules can be syntactically correct but still dysfunctional. yaraQA tries to find and report these issues to the author or maintainer of a YARA rule set.\n\nThe issues yaraQA tries to detect are e.g.:\n\n- rules that are syntactically correct but never match due to errors in the condition (e.g. rule with one string and `2 of them` in the condition)\n- rules that use string and modifier combinations that are probably wrong (e.g. `$ = \"\\\\Debug\\\\\" fullword`)\n- performance issues caused by short atoms, repeating characters or loops (e.g. `$ = \"AA\"`; can be excluded from the analysis using `--ignore-performance`)\n\nI'm going to extend the test set over time. Each minor version will include new features or new tests.\n\n## Install requirements\n\n```bash\npip install -r requirements.txt\n```\n\n## Usage\n\n```bash\nusage: yaraQA.py [-h] [-f yara files [yara files ...]] [-d yara files [yara files ...]] [-o outfile] [-b baseline] [-l level]\n                 [--ignore-performance] [--debug]\n\nYARA RULE ANALYZER\n\noptional arguments:\n  -h, --help            show this help message and exit\n  -f yara files [yara files ...]\n                        Path to input files (one or more YARA rules, separated by space)\n  -d yara files [yara files ...]\n                        Path to input directory (YARA rules folders, separated by space)\n  -o outfile            Output file that lists the issues (JSON, default: 'yaraQA-issues.json') \n  -b baseline           Use a issues baseline (issues found and reviewed before) to filter issues\n  -l level              Minium level to show (1=informational, 2=warning, 3=critical)\n  --ignore-performance  Suppress performance-related rule issues\n  --debug               Debug output\n```\n\n## Try it out\n\n```bash\npython3 yaraQA.py -d ./test/\n```\n\nSuppress all performance issues and only show detection / logic issues.\n```bash\npython3 yaraQA.py -d ./test/ --ignore-performance\n```\n\nSuppress all issues of informational character\n```bash\npython3 yaraQA.py -d ./test/ -level 2\n```\n\nUse a baseline to only see new issues (not the ones that you've already reviewed). The baseline file is an old JSON output of a reviewed state.\n\n```bash\npython3 yaraQA.py -d ./test/ -b yaraQA-reviewed-issues.json\n```\n\n## Example Rules with Issues\n\nExample rules with issues can be found in the `./test` folder.\n\n## Output\n\nyaraQA writes the detected issues to a file named `yaraQA-issues.json` by default.\n\nThis listing shows an example of the output generated by yaraQA in JSON format:\n\n```json\n[\n    {\n        \"rule\": \"Demo_Rule_1_Fullword_PDB\",\n        \"id\": \"SM1\",\n        \"issue\": \"The rule uses a PDB string with the modifier 'wide'. PDB strings are always included as ASCII strings. The 'wide' keyword is unneeded.\",\n        \"element\": {\n            \"name\": \"$s1\",\n            \"value\": \"\\\\\\\\i386\\\\\\\\mimidrv.pdb\",\n            \"type\": \"text\",\n            \"modifiers\": [\n                \"ascii\",\n                \"wide\",\n                \"fullword\"\n            ]\n        },\n        \"level\": \"info\",\n        \"type\": \"logic\",\n        \"recommendation\": \"Remove the 'wide' modifier\"\n    },\n    {\n        \"rule\": \"Demo_Rule_1_Fullword_PDB\",\n        \"id\": \"SM2\",\n        \"issue\": \"The rule uses a PDB string with the modifier 'fullword' but it starts with two backslashes and thus the modifier could lead to a dysfunctional rule.\",\n        \"element\": {\n            \"name\": \"$s1\",\n            \"value\": \"\\\\\\\\i386\\\\\\\\mimidrv.pdb\",\n            \"type\": \"text\",\n            \"modifiers\": [\n                \"ascii\",\n                \"wide\",\n                \"fullword\"\n            ]\n        },\n        \"level\": \"warning\",\n        \"type\": \"logic\",\n        \"recommendation\": \"Remove the 'fullword' modifier\"\n    },\n    {\n        \"rule\": \"Demo_Rule_2_Short_Atom\",\n        \"id\": \"PA2\",\n        \"issue\": \"The rule contains a string that turns out to be a very short atom, which could cause a reduced performance of the complete rule set or increased memory usage.\",\n        \"element\": {\n            \"name\": \"$s1\",\n            \"value\": \"{ 01 02 03 }\",\n            \"type\": \"byte\"\n        },\n        \"level\": \"warning\",\n        \"type\": \"performance\",\n        \"recommendation\": \"Try to avoid using such short atoms, by e.g. adding a few more bytes to the beginning or the end (e.g. add a binary 0 in front or a space after the string). Every additional byte helps.\"\n    },\n    {\n        \"rule\": \"Demo_Rule_3_Fullword_FilePath_Section\",\n        \"id\": \"SM3\",\n        \"issue\": \"The rule uses a string with the modifier 'fullword' but it starts and ends with two backslashes and thus the modifier could lead to a dysfunctional rule.\",\n        \"element\": {\n            \"name\": \"$s1\",\n            \"value\": \"\\\\\\\\ZombieBoy\\\\\\\\\",\n            \"type\": \"text\",\n            \"modifiers\": [\n                \"ascii\",\n                \"fullword\"\n            ]\n        },\n        \"level\": \"warning\",\n        \"type\": \"logic\",\n        \"recommendation\": \"Remove the 'fullword' modifier\"\n    },\n    {\n        \"rule\": \"Demo_Rule_4_Condition_Never_Matches\",\n        \"id\": \"CE1\",\n        \"issue\": \"The rule uses a condition that will never match\",\n        \"element\": {\n            \"condition_segment\": \"2 of\",\n            \"num_of_strings\": 1\n        },\n        \"level\": \"error\",\n        \"type\": \"logic\",\n        \"recommendation\": \"Fix the condition\"\n    },\n    {\n        \"rule\": \"Demo_Rule_5_Condition_Short_String_At_Pos\",\n        \"id\": \"PA1\",\n        \"issue\": \"This rule looks for a short string at a particular position. A short string represents a short atom and could be rewritten to an expression using uint(x) at position.\",\n        \"element\": {\n            \"condition_segment\": \"$mz at 0\",\n            \"string\": \"$mz\",\n            \"value\": \"MZ\"\n        },\n        \"level\": \"warning\",\n        \"type\": \"performance\",\n        \"recommendation\": \"\"\n    },\n    {\n        \"rule\": \"Demo_Rule_5_Condition_Short_String_At_Pos\",\n        \"id\": \"PA2\",\n        \"issue\": \"The rule contains a string that turns out to be a very short atom, which could cause a reduced performance of the complete rule set or increased memory usage.\",\n        \"element\": {\n            \"name\": \"$mz\",\n            \"value\": \"MZ\",\n            \"type\": \"text\",\n            \"modifiers\": [\n                \"ascii\"\n            ]\n        },\n        \"level\": \"warning\",\n        \"type\": \"performance\",\n        \"recommendation\": \"Try to avoid using such short atoms, by e.g. adding a few more bytes to the beginning or the end (e.g. add a binary 0 in front or a space after the string). Every additional byte helps.\"\n    },\n    {\n        \"rule\": \"Demo_Rule_6_Condition_Short_Byte_At_Pos\",\n        \"id\": \"PA1\",\n        \"issue\": \"This rule looks for a short string at a particular position. A short string represents a short atom and could be rewritten to an expression using uint(x) at position.\",\n        \"element\": {\n            \"condition_segment\": \"$mz at 0\",\n            \"string\": \"$mz\",\n            \"value\": \"{ 4d 5a }\"\n        },\n        \"level\": \"warning\",\n        \"type\": \"performance\",\n        \"recommendation\": \"\"\n    },\n    {\n        \"rule\": \"Demo_Rule_6_Condition_Short_Byte_At_Pos\",\n        \"id\": \"PA2\",\n        \"issue\": \"The rule contains a string that turns out to be a very short atom, which could cause a reduced performance of the complete rule set or increased memory usage.\",\n        \"element\": {\n            \"name\": \"$mz\",\n            \"value\": \"{ 4d 5a }\",\n            \"type\": \"byte\"\n        },\n        \"level\": \"warning\",\n        \"type\": \"performance\",\n        \"recommendation\": \"Try to avoid using such short atoms, by e.g. adding a few more bytes to the beginning or the end (e.g. add a binary 0 in front or a space after the string). Every additional byte helps.\"\n    },\n    {\n        \"rule\": \"Demo_Rule_6_Condition_Short_Byte_At_Pos\",\n        \"id\": \"SM3\",\n        \"issue\": \"The rule uses a string with the modifier 'fullword' but it starts and ends with two backslashes and thus the modifier could lead to a dysfunctional rule.\",\n        \"element\": {\n            \"name\": \"$s1\",\n            \"value\": \"\\\\\\\\Section\\\\\\\\in\\\\\\\\Path\\\\\\\\\",\n            \"type\": \"text\",\n            \"modifiers\": [\n                \"ascii\",\n                \"fullword\"\n            ]\n        },\n        \"level\": \"warning\",\n        \"type\": \"logic\",\n        \"recommendation\": \"Remove the 'fullword' modifier\"\n    }\n]\n```\n\n## Screenshots\n\n![yaraQA](./screens/yaraqa-1.png)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fneo23x0%2Fyaraqa","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fneo23x0%2Fyaraqa","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fneo23x0%2Fyaraqa/lists"}