gaelic-ghost/socket/author-yara-x-rules

Author YARA-X Rules

Overview

Create rules that detect the validated property the evidence supports, not a broader malware-family claim. Prefer structural combinations over unique-looking strings copied from one sample.

Read references/yara-x-rule-quality.md before selecting patterns or declaring coverage.

Workflow

1. Define the detection objective and non-goals.
2. Build the fixture set.

• Preserve representative positive samples and near-miss benign negatives with hashes and provenance.
• Use synthetic or redistributable fixtures for repository tests.

1. Select discriminators.

• Prefer format/module facts, byte structures, stable code/config fragments, and combinations of independently meaningful strings.
• Avoid mutable infrastructure, compiler boilerplate, paths, timestamps, or one generic API name as decisive evidence.

1. Author metadata and conditions.

• Include purpose, author, date, source/evidence reference, scope, confidence, and known limitations.
• Bound file type and size where it improves correctness or performance.

1. Validate with current YARA-X.

• Record version; compile/lint the rule; test all positives, negatives, malformed inputs, and a bounded benign corpus.
• Investigate timeouts, warnings, and module-undefined behavior.

1. Review false positives and coverage.

• Tune by improving evidence combinations, not by accumulating arbitrary exclusions.

1. Preserve regression evidence.

• Store allowed fixtures or deterministic generators, expected matches/non-matches, and rule revision.

Output

Return the rule, objective, evidence basis, fixture results, performance notes, known misses/false positives, and deployment limits.