YARA And Sigma Rules.

What are YARA and Sigma rules?

They are two written formats for detection rules, each aimed at a different kind of data. YARA describes malware by patterns. Sigma describes detections in a format that converts to SIEM queries.

What is a YARA rule?

The YARA project calls YARA the pattern matching swiss knife for malware researchers. It lets users create descriptions of malware families based on textual or binary patterns. The project says each description, also called a rule, consists of a set of strings and a boolean expression which determine its logic. A boolean expression is a condition that is either true or false. YARA is multi-platform, running on Windows, Linux and Mac OS X, and can be used through its command-line interface or from Python scripts with the yara-python extension.

What is a Sigma rule?

The Sigma project calls Sigma an open format for writing detection rules in YAML. YAML is a simple text format. A Sigma rule has a title, a log source that says which product and service the rule applies to, and detection logic that holds the selection criteria and conditions. The project says a single rule converts into a query for whichever SIEM you run, so rules are portable, vendor neutral and easy to share. A SIEM is a system that collects and searches security logs. The sigma-cli tool does the conversion, and pipelines, which are configuration files, handle field name mapping and log source adjustments for your own SIEM setup.

Why does it matter?

Both formats let a team write a detection once and keep it in plain text. Sigma is built to be shared across different SIEM products. This is general reasoning: a rule is only as good as its author, so rules often need testing on your own data before they are trusted.

How can you use them?

• Use YARA rules when you want to describe a malware family by its patterns.
• Use Sigma rules when you want to write a detection that can be converted for different SIEM products.
• Convert Sigma rules for the SIEM you already run.
• Test each rule on your own data and keep a note of what it is meant to catch.

Is a YARA rule the same as a Sigma rule?

No. A YARA rule is a set of strings and a condition that describe a malware family. A Sigma rule is a title, a log source and detection logic that converts into a SIEM query. A team can use both.

Are these rules the same as indicators of compromise?

Not exactly. An indicator of compromise is a single clue, such as a file hash. A rule can describe a pattern, which in general may still match when a small detail such as a hash changes.

Sources

• virustotal.github.io: YARA lets users describe malware families by textual or binary patterns; each rule is a set of strings and a boolean expression.
• sigmahq.io: Sigma is an open format for detection rules in YAML; rule has title, log source, detection logic; converts to SIEM queries; field mapping.
• GitHub (VirusTotal/yara): The YARA repository, described as the pattern matching swiss knife, with the source code of the tool.
• GitHub (SigmaHQ/sigma): The Sigma main rule repository, where detection engineers and threat hunters collaborate on open detection rules.