Anthropic-Cybersecurity-Skills/skills/performing-yara-rule-development-for-detection/references/standards.md

YARA Rule Development Standards

Rule Naming Convention

• Malware_Family_Variant: For specific malware variants
• APT_Group_Tool: For threat actor associated tools
• Exploit_CVE_YYYY_NNNN: For exploit payloads
• Technique_Name: For generic technique detection

Rule Quality Metrics

Metric	Target	Description
True Positive Rate	>99%	Detection of known samples
False Positive Rate	<0.1%	Matches on clean files
Scan Speed	>1000 files/s	Processing performance
Maintenance Burden	Low	Frequency of updates needed

String Types Reference

Type	Syntax	Use Case
ASCII text	"text" ascii	Plain text strings
Wide text	"text" wide	UTF-16LE encoded strings
Case-insensitive	"text" nocase	Variable casing
Hex pattern	{ AA BB CC }	Byte sequences
Wildcard hex	{ AA ?? CC }	Single byte wildcard
Jump hex	{ AA [2-4] CC }	Variable length gap
Regex	/pattern/	Complex pattern matching

MITRE ATT&CK Relevance

• T1027 - Obfuscated Files: Rules detect packed/encoded malware
• T1036 - Masquerading: Rules identify file mimicry
• T1059 - Command Interpreter: Rules detect malicious scripts

References

• YARA Documentation
• YARA Performance Guidelines