# VirusTotal/yara-x

A rewrite of YARA in Rust.

Repository: https://github.com/VirusTotal/yara-x
Canonical: https://ross.abutalabs.com/products/yara-x
Homepage: https://virustotal.github.io/yara-x/
Language: Rust
License: BSD-3-Clause
License Family: permissive
Last push: 2026-08-26T06:42:43+00:00

## Health v2 (maintenance only)
Score: 99/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 99, release rhythm 99, longevity 100
- inputs: {"age_days": 1419, "days_push": 7, "days_rel": 9, "gap_med": 16, "n_releases_24m": 34}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1260, forks 149 (observed 2026-08-28T04:04:09.941912+00:00)

## What it is
YARA-X is a pure Rust rewrite of YARA, the pattern matching swiss knife for malware researchers, designed to be faster, safer, and more user-friendly. It lets users write rules combining textual or binary patterns with boolean logic to identify malware families or other file characteristics, with APIs for C/C++, Python, and Go.

## Use cases
- scan files for malware family signatures with YARA rules
- write pattern matching rules for binary and text patterns
- integrate YARA rule scanning into a Python or Go application
- migrate existing YARA rules to a faster engine
- perform digital forensics file triage at scale
- match regular expressions and hex patterns in files

## When to choose
- you need fast, battle-tested YARA-compatible pattern matching in production
- you want memory-safe Rust implementation with C/C++, Python, or Go APIs
- you are starting new malware research or file classification workflows

## When to avoid
- you rely on YARA features or modules not yet supported by YARA-X
- you depend on legacy tooling tightly coupled to original YARA behavior

## Facets
- artifact type: library
- maturity: stable
- function: parser, search-engine, cli, sdk
- domain: security, developer-tools
- platform: windows, rust, python, go, cross-platform
- tags: yara, pattern-matching, malware-analysis, cybersecurity, forensics, rust-rewrite, command-line, linux, macos

## Member repositories
- VirusTotal/yara-x (main) score 99

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:09.941912+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T05:04:22.466483+00:00, confidence not recorded.
  - readme: https://github.com/VirusTotal/yara-x (fetched 2026-08-28T04:04:09.941912+00:00, sha fe47c3c46f9c)
  - homepage: https://virustotal.github.io/yara-x/ (fetched 2026-08-29T12:16:42.870575+00:00, sha 5b8c5b559ee0)
  - registry_crates: https://crates.io/api/v1/crates/yara-x (fetched 2026-08-29T12:16:42.879438+00:00, sha 63364da8b99f)
- Data as of 2026-08-30T08:39:29.467469+00:00.