yara-rule-authoring

Detection rules for malware that balance specificity with performance, avoiding false positives through careful string selection and atom optimization. Write detection rules that catch malware without drowning in false positives. This skill targets YARA-X , the Rust-based successor to legacy YARA. YARA-X powers VirusTotal's production systems and is the recommended implementation. See Migrating from Legacy YARA if you have existing rules. Strings must generate good atoms — YARA extracts 4-byte subsequences for fast matching. Strings with repeated bytes, common sequences, or under 4 bytes force slow bytecode verification on too many files. Target specific families, not categories — "Detects ransomware" catches everything and nothing.