Static Code Analysis
Scan a folder of files with YARA-X
Files in, YARA match rows out.
overview
What yara-x does
YARA-X scans every file in the connected folder and writes one JSONL row per rule match.
A Managed-fleet smoke placed the byte sequence f3 a0 80 a1 in sample.bin. The row named the rule Autorun_Invisible_Unicode_Tag_Chars.
The rules ship with the node. You connect the files to scan, not a separate rules folder.
source github.com/VirusTotal/yara-x
use cases
Where yara-x fits
Scan a dropped sample
Put the file in a folder and read the rule name from the JSONL row.
Scan a directory of artifacts
One folder input covers every file the upstream node wrote.
Keep the match path
Each row names the rule and the file path that triggered it.
reference
yara-x inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| input | FOLDER | --input | Folder to scan. |
Showing key inputs. yara-x exposes 1 inputs in total.
example
Run yara-x
yara-x --input ./samples{"rule": "Autorun_Invisible_Unicode_Tag_Chars", "evidence_kind": "yara_match", "evidence_path": "sample.bin"}guidance
Choosing yara-x
Use YARA-X to match byte patterns in files. Use Zircolite for Sigma rules over JSON logs, and Bandit for Python source.
bandit
Scans Python source for security plugins.
zircolite
Matches Sigma rules against JSON event logs.
malcontent-scan
Looks for risky behavior in package coordinates.
faq
yara-x questions
related
More Static Code Analysis tools
bandit
Python source in, JSON security findings out.
gitleaks
Detect hardcoded secrets in git repos and plain directories.
gosec
Go AST security scanner for credentials, crypto, and injection.
guarddog
A package coordinate in, indicator hits out.
malcontent-scan
A package coordinate in, behavior findings out.
osv-malicious
A package coordinate in, malware advisory rows out.
Run yara-x yourself
sample.bin containing the bytes f3 a0 80 a1 matched the Autorun_Invisible_Unicode_Tag_Chars rule.
Facts on this page come from the live Trickest tool library.