# YARA

<mark style="color:green;">**YARA Rules**</mark> allow analysts to define pattern-based detection logic using string matching and binary-level conditions. Originally designed for malware classification, YARA is also highly effective for detecting suspicious strings, tokens, and structural markers in exposed content within the Inopli DRP dataset.

YARA rules operate continuously on findings involving <mark style="color:green;">text bodies, source code, cloud storage leaks, and other artifacts</mark> where content analysis is meaningful.

***

### Rule Structure

A basic YARA rule consists of three main sections:

* <mark style="color:green;">**Meta**</mark> (optional)\
  Contains descriptive fields like `author`, `description`, or `severity`
* <mark style="color:green;">**Strings**</mark>\
  Defines patterns to match, including plaintext strings, hexadecimal byte patterns, or **r**<mark style="color:green;">**egular expressions (regex)**</mark>
* <mark style="color:green;">**Condition**</mark>\
  Boolean logic that defines when the rule should trigger

### Regex Support

YARA natively supports <mark style="color:green;">**regular expressions**</mark> using the `/regex/` syntax within the `strings` section. This enables analysts to detect:

* Obfuscated credentials
* Token formats (e.g., JWT, OAuth, API keys)
* File path structures
* Encoded indicators like Base64 or hex

Regex can be combined with modifiers like `nocase`, `wide`, or `ascii` to refine detection logic.

***

#### Use Cases

* Detect password patterns in HTML or JS sources
* Identify obfuscated malware strings in leaked ZIPs
* Flag exposure of client secrets in public cloud storage
* Match encoded backdoor calls in script-based payloads

***

### Incident Triggering

Once a YARA rule matches content in a DRP finding, the result is automatically enriched. If classified as a threat based on rule severity or context, it triggers an <mark style="color:green;">**incident in the Response module**</mark> for operational follow-up.