YARA scan

yara -r rules.yar <path>

Recursively scans a directory with YARA rules, looking for files that match known malware patterns or IOCs.

Run it when you have a set of YARA rules (your own, from the community, or from the vendor publishing the IOC) and you want to sweep a host or a repository for malware: yara -r walks the directory tree and reports the files that match, with the rule that triggered. It's the standard for content-based detection — YARA signatures detect the binary even if the name changes, something AVs based on hashes don't do. In an IR, scanning affected hosts and backup repositories with the rules of the attributed group is the step that confirms scope. In the malware analysis pipeline, YARA is the first filter for samples.

Don't use it on huge trees without narrowing down: scanning the whole disk with heavy rules takes hours and burns CPU — limit to relevant directories (binaries, Temp, downloads) or to the extensions of interest. Poorly written rules (overly generic patterns) produce false positives that pollute the result: validate each rule against a clean corpus before using it in production. And watch out: YARA sees the file on disk, not memory or processes — memory-only malware (most loaders) won't be detected with file scanning; for that you have YARA memory modules or the EDR.