YAR
Generated by scripts/gen-format-pages.py from docs/data/format-metadata/, FILE_FORMATS.csv and docs/formats-master.csv. Do not edit by hand: change the source, then run the script.
YARA Rules Preview.
At a glance
| Purpose | A YARA rules file: named rules with tags, metadata, strings and a condition, for malware detection. |
| Extensions | .yar |
| Poka parser | poka-yara |
| Viewer | poka-table-viewer |
| Depth tier | Parser with a shared viewer (see Depth tiers) |
| Breadth tier | B3 Core (see Breadth tiers) |
How much Poka reads
B3 Core. Only the main content type or types are decoded (for example geometry but not materials, layers or annotations, or only one version family). The list of gaps is substantial.
Confidence: medium (the reviewer read the code). Basis: Reviewed 2026-10-26: read parsers/poka-yara/src/main.rs (369 lines) and plugin.json. No unit tests or tests/samples.rs; the corpus has no .yar and .yara sample. Covers .yar and .yara. The table lists every rule with name, tags, modifiers (private, global), string and meta counts, author and description. Judgement: B3: every rule is listed, but its strings and condition are not shown.
What Poka does not read
- Strings (text, hex, regex) are counted, not shown
- Conditions are not shown
- Imports and includes are not listed (judgement from the code)
- Only the first 1,000 rules are listed
Libraries
Libraries Poka uses or has assessed for this format, with the status, licence and language the registry records.
- YARA-X (candidate; BSD-3-Clause; Rust; https://github.com/virustotal/yara-x) — VirusTotal Rust rewrite of YARA with a separate parser directory; main crate is a compiler/scanner, so use mainly for rule parsing and checking.
- boreal (candidate; Apache-2.0 OR MIT; Rust; https://github.com/vthib/boreal) — Rust YARA rules evaluator with a separate boreal-parser crate; pure Rust apart from an optional libmagic module.
Sources
- parsers/poka-yara/src/main.rs
- parsers/poka-yara/plugin.json