text/yara;text/x-yara
*.yara;*.yar
//
/*
*/
include
\\( # leading backslash
[\\\"nt] | # escaped character
x[0-9A-Fa-f]{2} # hex char
)
"
"
\%{escaped-character}
(?<![\w\.])
([a-fA-F0-9?]{2})+
(?![\w\.])
(?<![\w\.])
0[xX][a-fA-F0-9]+
(?![\w\.])
(?<![\w\.])
0[xX][a-fA-F0-9]*[g-zG-Z][a-zA-Z0-9]*
(?![\w\.])
(?<![\w\.])
(0|[1-9][0-9]*)
(?![\w\.])
(rule)
\s+
([a-zA-Z_]\w{0,127})
all
and
any
ascii
at
base64
base64wide
condition
contains
endswith
entrypoint
filesize
for
fullword
global
icontains
iendswith
istartswith
import
in
int8
int16
int32
int8be
int16be
int32be
matches
meta
nocase
not
or
of
private
rule
startswith
strings
them
uint8
uint16
uint32
uint8be
uint16be
uint32be
wide
xor
true
false