YARA compile

yara -r rules.yar <sample>

Scans a malware sample with YARA rules, checking if it matches signatures from known campaigns.

Run it when you have the sample (extracted with icat, from the sandbox, or from the endpoint) and want to know if it's known: YARA applies the rules — community ones (yara-rules, vendors) or your own — and reports matches with the rule and campaign context. It's the first step of static analysis: a sample that matches the APT29 rule or a specific ransomware rule is identified in seconds. In IR, the flow is standard: hash to VirusTotal + YARA with updated rules → sample is classified → deep analysis only if no match.

Don't use it as a complete analysis: YARA detects what's known — a sample without a rule (new or modified malware) won't match and can still be malicious; deep analysis (capa, FLOSS, sandbox) is necessary when there's no match. Poorly written or outdated rules give false negatives: the rule set is updated with vendor publications. And watch out for false positives: generic rules (common strings) match legitimate binaries — each match is reviewed with context (where the sample came from). For scanning a full directory, use recursive -r with tuned rules; for a specific sample, direct execution.