### Regex Optimization Examples

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/README.md

Examples showing the progression from bad to best practices for regex performance.

```yara
$s1 = /http:\/\/[.]*\.hta/	// greedy [.]*
```

```yara
$s1 = /http:\/\/[a-z0-9\.\/]{3,70}\.hta/ 	// better, with an the upper bound
```

```yara
$s1 = /mshta\.exe http:\/\/[a-z0-9\.\/]{3,70}\.hta/
```

--------------------------------

### Good String Examples

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/quick-reference.md

Examples of high-quality strings that provide strong atoms for efficient scanning.

```yara
"cmd.exe"
```

```yara
{ 4D 5A 90 00 }
```

```yara
/exec\s*\(/
```

```yara
{ 01 02 [1-10] 03 04 }
```

--------------------------------

### Plain String Examples

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/strings-best-practices.md

Demonstrates the performance difference between unique and common plain strings.

```yara
$unique = "ssh_authorized_keys"
```

```yara
$short = "is"
```

--------------------------------

### String Optimization Matrix Examples

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/quick-reference.md

Comparison of performance-impacting patterns and their optimized counterparts.

```yara
"GET"
```

```yara
"GET /api/v1/"
```

```yara
{ 00 00 00 00 }
```

```yara
{ 01 02 03 04 }
```

```yara
/\w*/
```

```yara
/.{1,30}/
```

```yara
/[-a-z]*@/
```

```yara
/@/
```

```yara
"cmd" nocase
```

```yara
/[Cc][Mm][Dd]/
```

```yara
{ ?? ?? 01 02 }
```

```yara
{ 01 02 [0-10] ?? }
```

--------------------------------

### Efficient Loop Example

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/conditions.md

Optimizes loop execution by adding file-type and size constraints before the loop.

```yara
strings:
    $common = "the"
    $header = "MZ"
condition:
    $header and  // Check specific file type first
    filesize < 10MB and  // Limit size
    for all i in (1..#$common) : (@$common[i] < 0x1000)
```

--------------------------------

### Uniform Content Examples

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/README.md

Examples of strings that should be avoided due to uniformity, which can lead to excessive matches.

```yara
$s1 = "22222222222222222222222222222222222222222222222222222222222222"
$s2 = "\x00\x20\x00\x20\x00\x20\x00\x20\x00\x20\x00\x20\x00\x20"  // wide formatted spaces
```

--------------------------------

### Leverage YARA 3.10+ Optimizations

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/version-notes.md

Example of using early exit conditions available in YARA 3.10 and later.

```yara
// YARA 3.10+ - Optimized
condition:
    filesize < 100MB and
    for any i in (1..#$string) : (some_condition)  // Early exit
```

--------------------------------

### Hex String Performance Examples

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/hex-strings.md

Examples of hex string patterns categorized by their performance characteristics in YARA scanning.

```yara
{ 4D 5A 90 00 }
```

```yara
{ 4D 5A [0-100] 50 45 }
```

```yara
{ 4D 5A [0-100] ?? FF }
```

```yara
(4D 5A | 7F 45)
```

```yara
{ ?? ?? 01 02 ?? ?? }
```

```yara
{ FF FF }
```

```yara
{ 01 02 [1-] FF FF }
```

```yara
{ ?? ?? ?? ?? }
```

--------------------------------

### PE Module Performance Example

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/modules.md

Demonstrates the overhead of importing the PE module, which triggers header parsing for every scanned file regardless of file type.

```yara
import "pe"

rule example {
    condition:
        pe.is_pe and pe.number_of_sections > 10
}
```

--------------------------------

### Position Concrete Bytes at Start

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/hex-strings.md

Prioritize placing concrete bytes at the beginning of patterns to improve prefix filtering.

```yara
strings:
    $weak = { ?? ?? ?? ?? 01 02 03 04 }  // Wildcard start, concrete end
```

```yara
strings:
    $strong = { 01 02 03 04 [0-100] ?? ?? ?? ?? }  // Concrete start, wildcard end
```

--------------------------------

### Inefficient Loop Example

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/conditions.md

An example of a high-cost loop that iterates over thousands of matches without prior filtering.

```yara
strings:
    $common = "the"  // Matches thousands of times
condition:
    for all i in (1..#$common) : (@$common[i] < 0x1000)
```

--------------------------------

### Check YARA Version

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/version-notes.md

Command to verify the currently installed version of YARA.

```bash
yara --version
```

--------------------------------

### Greedy Quantifier Example

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/regular-expressions.md

Demonstrates a standard greedy quantifier that matches the longest possible substring.

```yara
$pattern = /Tom.{0,2}/
```

--------------------------------

### YARA Pattern Format Examples

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/hex-strings.md

Examples of various YARA pattern formats categorized by their intended use case.

```yara
{ 7F 45 4C 46 }
```

```yara
{ 55 8B EC }
```

```yara
"cmd.exe"
```

```yara
/[Cc][Mm][Dd]\.exe/
```

```yara
{ 4D 5A [0-1024] 50 45 }
```

```yara
/http:\/\/[a-z0-9]+\.com/
```

--------------------------------

### Example YARA Rule

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/README.md

A sample rule demonstrating basic YARA syntax including imports, metadata, string definitions, and conditional logic.

```yara
import "math"
rule example_php_webshell_rule
{
    meta:
        description = "Just an example php webshell rule"
        date = "2021/02/16"
    strings:
        $php_tag = "<?php"
        $input1   = "GET"
        $input2   = "POST"
        $payload = /assert[\t ]{0,100}\(/
    condition:
        filesize < 20KB and
        $php_tag and
        $payload and
        any of ( $input* ) and
        math.entropy(500, filesize-500) >= 5
}
```

--------------------------------

### Bad String Examples

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/quick-reference.md

Examples of strings that cause performance degradation due to lack of unique atoms or unbounded complexity.

```yara
"is"
```

```yara
"GET"
```

```yara
{ 00 00 00 00 }
```

```yara
/\d+\.\d+\.\d+\.\d+/
```

```yara
/.*\.dll/
```

```yara
/[a-z]+/
```

```yara
"cmd.exe" nocase
```

--------------------------------

### YARA string modifier efficiency examples

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/strings-best-practices.md

Examples of various string modifier combinations and their impact on atom generation and performance.

```yara
"cmd.exe"
```

```yara
"cmd.exe" ascii
```

```yara
"cmd.exe" wide
```

```yara
"cmd.exe" ascii wide
```

```yara
"cmd.exe" nocase
```

```yara
"cmd.exe" wide nocase
```

```yara
"cmd.exe" ascii wide nocase
```

--------------------------------

### Best Pattern Example

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/atoms.md

Optimized pattern using long atoms and explicit offset ordering to avoid regex overhead.

```yara
strings:
    $a = "a_prefix_marker"
    $b = "b_prefix_marker"
condition:
    $a and $b and @a < @b
```

--------------------------------

### Hexadecimal String Patterns

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/strings-best-practices.md

Examples of efficient and inefficient hex strings, including the use of wildcards.

```yara
$header = { 4D 5A 90 00 }  // "MZ\x90\x00" - PE executable header
```

```yara
$padding = { 00 00 00 00 }
```

```yara
$pattern = { 01 02 [1-4] 03 04 05 06 }
```

--------------------------------

### Multiple Start Position Pattern

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/regular-expressions.md

Shows a pattern that triggers matches at all possible start positions, leading to high match counts.

```yara
$pattern = /.{0,2}Tom/
```

--------------------------------

### Optimize Hex String Length

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/hex-strings.md

Examples demonstrating the impact of concrete segment length on atom creation and YARA performance.

```yara
strings:
    $bad = { ?? ?? ?? ?? 01 02 }  // 4 wildcards, then short atom
```

```yara
strings:
    $better = { 01 02 ?? ?? 03 04 05 06 }  // Longer concrete segment
```

```yara
strings:
    $best = { 01 02 03 04 [0-10] 05 06 07 08 }  // Two 4-byte atoms
```

--------------------------------

### Better Pattern Example

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/atoms.md

An improvement using a bounded quantifier, though it still results in short atoms.

```yara
$re = /a.{1,30}b/
```

--------------------------------

### Examples of inefficient strings

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/README.md

Strings that result in poor performance due to short or common atoms.

```text
{00 00 00 00 [1-2] FF FF [1-2] 00 00 00 00}
{AB  [1-2] 03 21 [1-2] 01 02}
/a.*b/
/a(c|d)/
```

--------------------------------

### Bad Pattern Example

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/atoms.md

A pattern that produces 1-byte atoms, leading to excessive candidate generation.

```yara
$re = /a.*b/
```

--------------------------------

### Examples of strings without atoms

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/README.md

Strings that lack fixed substrings, forcing evaluation at every file offset.

```text
/\w.*\d/
/[0-9]+\n/
```

--------------------------------

### Define YARA rule with strings and conditions

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/yara-scanning-process.md

Example of a YARA rule structure used to demonstrate atom extraction during the compilation phase.

```yara
rule example {
    strings:
        $php_tag = "<?php"
        $input1 = "GET"
        $input2 = "POST"
        $payload = /assert[\t ]{0,100}\(/
    condition:
        $php_tag and $payload and any of ($input*)
}
```

--------------------------------

### Optimizing Wildcard Hex Patterns

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/common-pitfalls.md

Avoid starting hex patterns with wildcards, as they prevent atom extraction. Rearrange patterns to lead with concrete byte segments.

```yara
strings:
    $pattern = { ?? ?? ?? ?? [0-100] 01 02 03 04 }
condition:
    $pattern
```

```yara
strings:
    $pattern = { 01 02 03 04 [0-100] 05 06 07 08 }  // No wildcards at start
condition:
    $pattern
```

--------------------------------

### Avoid short strings in YARA rules

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/atoms.md

Short strings like 'GET' create 3-byte atoms that lead to excessive false positives.

```yara
strings:
    $common = "GET"
    $less_common = "XMLHttpRequest"
condition:
    $common and $less_common
```

--------------------------------

### YARA Error Message Example

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/README.md

Example of an error message generated when a string causes too many matches.

```text
error scanning yara-killer.dat: string "$mz" in rule "shitty_mz" caused too many matches
```

--------------------------------

### Performance Cost Comparison

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/conditions.md

A comparison of execution time for inefficient versus efficient condition ordering across 1 million files.

```text
Inefficient Order:
1,000,000 entropy calculations × 500ms = 500,000 seconds (5.8 days)
```

```text
Efficient Order:
1,000,000 filesize checks × 0.1ms = 100 seconds
+   50,000 PE header checks × 0.2ms = 10 seconds
+       100 entropy calculations × 500ms = 50 seconds
Total = 160 seconds (2.7 minutes)
```

--------------------------------

### Naive Regex String Sequencing

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/advanced-techniques.md

Demonstrates a performance-heavy approach using regex for relative string positioning.

```yara
strings:
    $pattern = /exec.*\/bin\/sh/
condition:
    $pattern
```

--------------------------------

### Optimize Module Evaluation with Pre-filters

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/common-pitfalls.md

Use a header check to verify file type before invoking module-specific functions to avoid unnecessary parsing overhead.

```yara
import "pe"

rule example {
    condition:
        pe.number_of_sections > 5 and
        $rare_signature
}
```

```yara
import "pe"

rule example {
    condition:
        uint16(0) == 0x5A4D and
        pe.number_of_sections > 5 and
        $rare_signature
}
```

--------------------------------

### Optimize Entropy Calculation Order

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/common-pitfalls.md

Place cheap header checks before expensive entropy calculations to ensure the calculation only runs on relevant files.

```yara
import "math"

rule example {
    condition:
        math.entropy(0, filesize) > 7.0 and
        uint16(0) == 0x5A4D
}
```

```yara
import "math"

rule example {
    condition:
        uint16(0) == 0x5A4D and
        math.entropy(0, filesize) > 7.0
}
```

--------------------------------

### Condition Ordering Template

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/quick-reference.md

Order conditions from cheapest to most expensive to ensure early exit for non-matching files.

```yara
condition:
    filesize < 100MB and              // 1. Eliminate huge files (cheap)
    uint16(0) == 0x5A4D and           // 2. Check file type (cheap)
    $specific_signature and            // 3. String match (pre-scanned)
    for any i in (1..#$sig): (...)     // 4. Loop over matches (medium)
    math.entropy(0, 10000) > 7.0       // 5. Entropy on region (expensive)
```

--------------------------------

### Use the Magic Module

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/README.md

The magic module provides exact matches but is not available on Windows and can slow down scanning.

```yara
import "magic"
rule gif_2 {
  condition:
    magic.mime_type() == "image/gif"
}
```

--------------------------------

### Bad Atom Patterns

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/atoms.md

Examples of patterns that cause performance degradation due to being too short, too common, or repetitive.

```yara
"ab"
```

```yara
\x00\x00\x00\x00
```

```yara
aaaa
```

```yara
a
```

```yara
\x00
```

--------------------------------

### Identify PE files efficiently

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/README.md

Use a direct byte check instead of the PE module to avoid parsing the entire file structure.

```yara
uint16(0) == 0x5A4D
```

--------------------------------

### Module Usage Pre-Filtering

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/quick-reference.md

Avoid evaluating expensive modules on every file by using cheap byte-level checks as a pre-filter.

```yara
// SLOW - modules evaluate for every file
import "pe"
condition:
    pe.number_of_sections > 5 and $string

// FAST - pre-filter to PE files first
import "pe"
condition:
    uint16(0) == 0x5A4D and pe.number_of_sections > 5 and $string
```

--------------------------------

### High Atom Generation String Definitions

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/README.md

Examples of definitions that generate multiple atoms due to case-insensitivity or complex patterns.

```yara
$s5 = "cmd.exe" nocase      (all different cases, e.g. "Cmd.", "cMd.", "cmD." ..)
```

```yara
$re = /[Pp]assword/
```

```yara
$re = /(a|b)cde/
$hex = {C7 C3 00 (31 | 33)}
```

--------------------------------

### Avoid Iterating Over Filesize

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/README.md

Looping based on filesize is inefficient as it scales linearly with the size of the input file.

```yara
for all i in (1..filesize) : ($a at i)
```

--------------------------------

### Avoid Wildcard-Heavy Patterns

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/hex-strings.md

Leading wildcards prevent atom extraction. Rearrange patterns to place concrete bytes at the start.

```yara
strings:
    $bad = { ?? ?? ?? ?? ?? ?? ?? ?? 01 02 03 04 }
```

```yara
strings:
    $better = { 01 02 03 04 [0-8] ?? ?? ?? ?? ?? ?? ?? ?? }
```

--------------------------------

### Basic Loop Syntax

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/conditions.md

Standard syntax for iterating over string matches or numeric ranges.

```yara
condition:
    for all i in (1..#$string) : (something)
```

--------------------------------

### Removing Leading Quantifiers in Regex

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/common-pitfalls.md

Avoid leading quantifiers that cause multiple matches for the same string at different start positions.

```yara
strings:
    $pattern = /[-a-z0-9._%+]*@[-a-z0-9.]{2,10}\.[a-z]{2,4}/
condition:
    $pattern
```

```yara
strings:
    $pattern = /[-a-z0-9._%+]@[-a-z0-9.]{2,10}\.[a-z]{2,4}/
condition:
    $pattern
```

--------------------------------

### Inefficient YARA Condition Ordering

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/conditions.md

An example of poor performance where an expensive entropy calculation is evaluated before cheap header and string checks.

```yara
strings:
    $sig = "malware_signature"
condition:
    math.entropy(0, filesize) > 7.0 and
    uint16(0) == 0x5A4D and
    $sig
```

--------------------------------

### Optimal YARA Rule Template

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/quick-reference.md

A template demonstrating best practices for string selection, regex anchoring, and condition ordering to ensure high performance.

```yara
rule effective_detection {
    meta:
        description = "Concise description"
        author = "Author name"
        date = "2024-01-01"
    
    strings:
        // Long, unique strings (4+ bytes, specific content)
        $sig1 = "unique_signature_value"
        $sig2 = { 4D 5A 90 00 }
        
        // Bounded regex with fixed anchor
        $pattern = /MZ[\x00-\xFF]{0,100}PE\x00\x00/
        
        // Avoid: short strings, unbounded quantifiers, excessive nocase
        // $bad = "ab"           // Too short
        // $ugly = /\w*/         // No atom
        // $wrong = "x" nocase   // Single char, case insensitive
    
    condition:
        // Cheap checks first
        filesize < 100MB and
        uint16(0) == 0x5A4D and
        
        // String matches (pre-scanned)
        ($sig1 or $sig2) and
        
        // Medium cost
        for any i in (1..#$pattern) : (
            @$pattern[i] < filesize - 100
        ) and
        
        // Expensive operations last (if needed)
        // math.entropy(0, 10000) > 7.0
}
```

--------------------------------

### YARA Performance Verification Commands

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/quick-reference.md

Command-line tools for validating syntax, checking match counts, and profiling rule execution time.

```bash
yara -c rule.yar
```

```bash
yara -s rule.yar file
```

```bash
yara -d rule.yar file
```

```bash
time yara rule.yar large_file
```

--------------------------------

### Optimize condition ordering

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/modules.md

Compares inefficient and efficient ordering of conditions to minimize expensive module parsing.

```yara
import "pe"

rule example {
    condition:
        pe.is_pe and
        pe.is_64bit and
        filesize < 10MB
}
```

```yara
import "pe"

rule example {
    condition:
        filesize < 10MB and
        pe.is_pe and
        pe.is_64bit
}
```

--------------------------------

### Regex with Poor Atoms

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/regular-expressions.md

Patterns starting with character classes lack fixed prefixes, forcing the regex engine to evaluate at many file offsets.

```yara
$pattern = /\d+\.\d+\.\d+\.\d+/
```

--------------------------------

### Profile YARA Rules

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/conditions.md

Use the -d flag to check execution timing and verify performance improvements.

```bash
yara -d rule.yar test_file  # Check execution with debugging
```

--------------------------------

### Fixing Regex Without Atoms

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/common-pitfalls.md

Avoid regex patterns starting with character classes that lack fixed substrings. Adding a fixed anchor allows YARA to extract atoms for efficient matching.

```yara
strings:
    $pattern = /\d+\.\d+\.\d+\.\d+/  // IP address pattern
condition:
    $pattern
```

```yara
strings:
    $pattern = /tcp:\/\/\d+\.\d+\.\d+\.\d+/  // "tcp://" is fixed prefix
condition:
    $pattern
```

--------------------------------

### Avoid Magic Module for File Identification

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/modules.md

The magic module is slow and platform-dependent; prefer header checks for file identification.

```yara
import "magic"

rule find_executables {
    condition:
        magic.mime_type() == "application/x-dosexec"
}
```

```yara
rule find_executables {
    condition:
        uint16(0) == 0x5A4D and uint32(0x3C) < 0x400
}
```

--------------------------------

### Reorder Conditions by Cost

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/conditions.md

Place inexpensive checks like filesize and header validation before expensive operations to minimize processing time.

```yara
condition:
    filesize < 100MB and           // Fast, eliminates huge files
    uint16(0) == 0x5A4D and        // Fast, selects PE files (1%)
    $rare_string and               // Already matched, free from scanning
    math.entropy > 7.0             // Expensive, but only for matching rare string
```

--------------------------------

### Regex vs Offset-based Matching

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/README.md

Comparison between a slow regex approach and a faster approach using string offsets.

```yara
$ = /exec.*\/bin\/sh/
```

```yara
strings:
  $exec = "exec" 
  $sh   = "/bin/sh"
conditions:
  $exec and $sh and
  @exec < @sh
```

--------------------------------

### Integer Range Loop Short-Circuiting

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/conditions.md

Demonstrates short-circuit behavior for integer range loops introduced in YARA 3.10.

```yara
condition:
    for all i in (0..100) : (false)  // Stops after first false
    for any i in (0..100) : (true)   // Stops after first true
```

--------------------------------

### Optimize YARA Rule Performance

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/README.md

Demonstrates the transition from a slow, inefficient rule to an optimized version by improving atom length and reordering conditions.

```yara
import "math"
rule slow_rule {
    strings:
        $s = "is"  // 2-byte atom
    condition:
        math.entropy(0, filesize) > 7.0 and
        uint16(0) == 0x5A4D and
        $s
}
```

```yara
import "math"
rule fast_rule {
    strings:
        $s = "is_specific_signature_marker"  // 4+ byte atom
    condition:
        filesize < 100MB and
        uint16(0) == 0x5A4D and
        $s and
        math.entropy(0, 10000) > 7.0  // Limited region
}
```

--------------------------------

### Detect PE files using portable header check

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/modules.md

A platform-independent approach that validates the MZ signature and a reasonable PE offset.

```yara
rule custom_pe_check {
    condition:
        uint16(0) == 0x5A4D and  // "MZ" signature
        uint32(0x3C) < 0x400     // Reasonable PE offset
}
```

--------------------------------

### Using Hex Strings for Binary Patterns

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/regular-expressions.md

Prefer hex strings with jump wildcards over regex for binary data to improve matching efficiency.

```yara
strings:
    $pattern = /MZ.{0,1024}\x50\x45/
condition:
    $pattern
```

```yara
strings:
    $pattern = { 4D 5A [0-1024] 50 45 }
condition:
    $pattern
```

--------------------------------

### Optimize Integer Range Loops in YARA 3.10+

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/version-notes.md

Utilize short-circuiting behavior in loops to terminate early when the condition outcome is determined. This requires YARA 3.10 or later.

```yara
// YARA 3.10+ - Optimized
condition:
    for all i in (0..100) : (false)  // Stops immediately on first false
    for any i in (0..100) : (true)   // Stops immediately on first true
```

--------------------------------

### Combined Early-Exit Conditions

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/advanced-techniques.md

Uses filesize limits, match count thresholds, and the 'for any' operator to terminate loops as soon as a condition is met.

```yara
strings:
    $common_pattern = "pattern"
condition:
    filesize < 1MB and  // Eliminate huge files
    #$common_pattern < 50 and  // Limited matches
    for any i in (1..#$common_pattern) : (  // for ANY, not for ALL
        @$common_pattern[i] < 0x1000
    )
```

--------------------------------

### Iterate over PE sections

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/modules.md

Demonstrates an acceptable use of module functions within a loop for deep inspection of section sizes.

```yara
import "pe"

rule example {
    condition:
        for all i in (1..pe.number_of_sections) : (
            pe.sections[i].size > 0x1000
        )
}
```

--------------------------------

### Use byte alternatives in hex strings

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/hex-strings.md

Matches one of several specified byte values at a specific position.

```yara
strings:
    $pattern = { C7 C3 00 (31 | 33) }  // Last byte is 0x31 or 0x33
```

--------------------------------

### Optimize Condition Ordering

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/version-notes.md

Reordering conditions to ensure cheap checks execute first, leveraging short-circuit evaluation.

```yara
// YARA <3.7 - No short-circuit benefit
condition:
    expensive_check and simple_check

// YARA 3.7+ - Now benefits from short-circuit
condition:
    simple_check and expensive_check  // Optimized order
```

--------------------------------

### Define Minimum YARA Version in Metadata

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/version-notes.md

Standard practice for documenting the minimum required YARA version within rule metadata.

```yara
meta:
    yara_minimum_version = "3.10"
```

--------------------------------

### Bounded vs Unbounded Quantifier Comparison

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/regular-expressions.md

Compares a slow, unbounded regex pattern with a fast, bounded alternative to prevent performance degradation.

```yara
// SLOW - unbounded
$pattern = /{\s*"key"\s*:\s*"[^"]*"

// FAST - bounded
$pattern = /{\s*"key"\s*:\s*"[^"]{1,1000}"/
```

--------------------------------

### Performant PE Module Usage

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/modules.md

Use the PE module only after filtering files with header checks to minimize parsing overhead.

```yara
import "pe"

rule suspicious_sections {
    condition:
        filesize < 10MB and
        uint16(0) == 0x5A4D and  // Filter to PE files first
        any of them               // Other conditions
        pe.sections[pe.number_of_sections].size == 0  // Need precise section count
}
```

--------------------------------

### Simple Hex Pattern Atom Selection

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/hex-strings.md

Demonstrates atom selection for a static 4-byte sequence without wildcards.

```yara
strings:
    $header = { 4D 5A 90 00 }
```

--------------------------------

### Unbounded File Iteration

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/common-pitfalls.md

Iterating over the entire file size can lead to performance degradation on large files.

```yara
strings:
    $marker = "XX"
condition:
    for all i in (1..filesize) : ($marker at i)
```

--------------------------------

### Calculate Entropy with Byte Range Sampling

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/advanced-techniques.md

Uses a 64KB sample size and a higher threshold combined with a signature check to mitigate false positives.

```yara
import "math"

rule sampled_entropy {
    condition:
        uint16(0) == 0x5A4D and
        filesize > 100KB and
        // Check entropy of first 64KB (common for executable header section)
        math.entropy(0, 65536) > 7.5 and  // Higher threshold for smaller sample
        // Require confirming signature for false positive mitigation
        $malware_signature
}
```

--------------------------------

### Optimize Math Module Entropy Calculations

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/modules.md

Entropy calculations are expensive; limit the scope to specific regions rather than the entire file.

```yara
import "math"

rule high_entropy {
    condition:
        math.entropy(0, filesize) > 7.0
}
```

```yara
import "math"

rule compressed_section {
    condition:
        math.entropy(0x1000, 0x10000) > 7.0  // Check only specific region
}
```

--------------------------------

### AND Short-Circuit Condition

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/conditions.md

Place inexpensive checks first to prevent unnecessary execution of costly functions like math.entropy.

```yara
condition:
    uint16(0) == 0x5A4D and 
    math.entropy(0, filesize) > 7.0 and
    $suspicious_string
```

--------------------------------

### Optimized String Definitions

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/README.md

Recommended approach for handling variants by defining strings separately to avoid performance degradation.

```yara
$re1 = /acde/
$re2 = /bcde/
$hex1 = {C7 C3 00 31}
$hex2 = {C7 C3 00 33}
```

--------------------------------

### Conceptual Probabilistic Scoring in YARA

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/advanced-techniques.md

Demonstrates a conceptual approach to weighted scoring using string matches. Note that YARA does not natively support arithmetic operations in conditions.

```yara
import "math"

rule probabilistic_scoring {
    meta:
        description = "Detection via cumulative evidence scoring"
    
    strings:
        $definite_indicator = "KNOWN_MALWARE_ID"
        $strong_indicator1 = "suspiciously_encoded_string"
        $strong_indicator2 = "dangerous_api_sequence"
        $weak_indicator1 = "http://"
        $weak_indicator2 = "temp_file_creation"
    
    condition:
        (
            ($definite_indicator * 100) +
            ($strong_indicator1 * 30) +
            ($strong_indicator2 * 30) +
            ($weak_indicator1 * 5) +
            ($weak_indicator2 * 5)
        ) >= 50
}
```

--------------------------------

### Implement dual-rule pattern for malware variants

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/advanced-techniques.md

Uses a core classifier rule to filter traffic before evaluating specific variant rules, improving performance through early short-circuiting.

```yara
// Rule 1: Family classifier (checks only if malware is in this family)
rule malware_family_core {
    meta:
        family = "Trojan.Banker"
        severity = "high"
    condition:
        uint16(0) == 0x5A4D and
        $banker_c2_beacon  // Unique C2 communication pattern
}

// Rule 2: Variant detector (specific variant details)
rule malware_family_core_variant_a {
    meta:
        family = "Trojan.Banker"
        variant = "A"
        severity = "high"
    condition:
        // Quick family check first
        uint16(0) == 0x5A4D and
        $banker_c2_beacon and
        // Variant-specific signature
        $variant_a_unique_signature
}

// Rule 3: Another variant
rule malware_family_core_variant_b {
    meta:
        family = "Trojan.Banker"
        variant = "B"
    condition:
        uint16(0) == 0x5A4D and
        $banker_c2_beacon and
        $variant_b_unique_signature
}
```

--------------------------------

### YARA Regex Matching Behavior

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/README.md

Demonstrates how YARA handles anchored and suffix-varying regular expressions.

```yara
$re1 = /Tom.{0,2}/		// will find Tomxx in "Tomxx"
$re2 = /.{0,2}Tom/      // will find Tom, xTom, xxTom in "xxTom"
```

--------------------------------

### Optimized Offset-Based Sequencing

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/advanced-techniques.md

Uses integer offset comparisons instead of regex to improve performance by 10-100x.

```yara
strings:
    $exec = "exec"
    $shell = "/bin/sh"
condition:
    $exec and $shell and @exec < @shell
```

--------------------------------

### Define File Signature Hex Patterns

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/hex-strings.md

Use specific byte sequences for common file headers to ensure high performance.

```yara
// PE Executable Header
$pe_header = { 4D 5A }

// ELF Executable Header  
$elf_header = { 7F 45 4C 46 }

// ZIP File
$zip_header = { 50 4B 03 04 }

// PDF File
$pdf_header = { 25 50 44 46 }

// GIF Image (87a or 89a format)
$gif_header_87 = { 47 49 46 38 37 61 }
$gif_header_89 = { 47 49 46 38 39 61 }
```

--------------------------------

### Detect PE files using header check

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/modules.md

Performs a fast 16-bit integer read at offset 0 to identify PE files without full module parsing.

```yara
rule example {
    condition:
        uint16(0) == 0x5A4D  // "MZ" in hex
}
```

--------------------------------

### Detect PE files using PE module

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/modules.md

Uses the PE module to identify files, which triggers full header parsing for every scanned file.

```yara
import "pe"

rule example {
    condition:
        pe.is_pe
}
```

--------------------------------

### Looping Over Match Offsets

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/common-pitfalls.md

Iterating over string match offsets instead of file offsets significantly reduces the number of loop iterations.

```yara
strings:
    $marker = "XX"
condition:
    $marker and
    for all i in (1..#$marker) : (@$marker[i] < 10000)
```

--------------------------------

### Identify Selective Conditions

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/conditions.md

Order conditions to eliminate the majority of files as early as possible using high-selectivity checks.

```yara
condition:
    uint16(0) == 0x5A4D and        // Selects 1% of files (PE files)
    $rare_string and               // Selects 0.1% of remaining
    math.entropy > 7.0             // Selects 5% of remaining
```

--------------------------------

### Define Magic Headers Manually

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/README.md

Use manual header checks instead of the magic module to ensure cross-platform compatibility and better performance.

```yara
rule gif_1 {
  condition:
    (uint32be(0) == 0x47494638 and uint16be(4) == 0x3961) or
    (uint32be(0) == 0x47494638 and uint16be(4) == 0x3761)
}
```

--------------------------------

### Calculate Entropy for Specific File Types

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/advanced-techniques.md

Restricts entropy calculation to PE files under 10MB to avoid unnecessary processing.

```yara
import "math"

rule selective_entropy {
    condition:
        uint16(0) == 0x5A4D and  // PE files only
        filesize < 10MB and  // Skip huge files
        math.entropy(0, filesize) > 7.0
}
```

--------------------------------

### Verifying YARA Fixes via CLI

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/common-pitfalls.md

Use the -s flag with the YARA CLI to inspect match counts before and after applying fixes.

```bash
# Before fix
yara -s rule.yar problematic_file  # Shows thousands+ matches

# After fix
yara -s rule.yar problematic_file  # Shows reasonable number of matches (1-1000)
```

--------------------------------

### Calculate Entropy on All Files

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/advanced-techniques.md

Calculates entropy for every scanned file, which is highly inefficient for large datasets.

```yara
import "math"

rule all_files_check {
    condition:
        math.entropy(0, filesize) > 7.0
}
```

--------------------------------

### Efficient YARA Condition Ordering

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/conditions.md

An optimized version of the rule that uses cheap filesize and header checks to fail fast before performing expensive operations.

```yara
strings:
    $sig = "malware_signature"
condition:
    filesize < 20MB and
    uint16(0) == 0x5A4D and
    $sig and
    math.entropy(0, filesize) > 7.0
```

--------------------------------

### Implement unbounded jumps in hex strings

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/hex-strings.md

Matches one or more bytes. Avoid this pattern as it can lead to poor performance.

```yara
strings:
    $pattern = { 4D 5A [1-] FF FF }  // Skip 1 or more bytes
```

--------------------------------

### Optimizing For-Loop Conditions

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/README.md

Use short-circuit evaluation to prevent expensive loops from executing unless necessary, and apply bounds to iteration ranges.

```YARA
strings:
	$mz = "MZ"
	...
condition:
	$mz at 0 and for all i in (1..filesize) : ( whatever )
```

```YARA
$mz at 0 and filesize < 100KB and for all i in (1..filesize) : ( whatever )
```

--------------------------------

### Detect file type using Magic module

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/modules.md

Relies on the magic module to determine MIME types, which is slow and platform-dependent.

```yara
import "magic"

rule example {
    condition:
        magic.mime_type() == "application/x-dosexec"
}
```

--------------------------------

### Bounded Offset Check Optimization

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/advanced-techniques.md

Avoids loops entirely by restricting the search range for a string to a specific region.

```yara
strings:
    $common_pattern = "pattern"
    $related_string = "related"
condition:
    ($common_pattern in range(0, 0x1000)) and
    $related_string
```

--------------------------------

### Optimize nocase string matching

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/atoms.md

Avoid nocase on short strings to prevent atom multiplication. Use regex character classes instead.

```yara
strings:
    $cmd = "cmd.exe" nocase
```

--------------------------------

### Minimize Wildcards

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/hex-strings.md

Avoid scattering wildcards to maintain atom continuity.

```yara
strings:
    $bad = { ?? ?? 01 ?? ?? 02 ?? ?? 03 }  // Scattered bytes
```

```yara
strings:
    $better = { 01 02 03 [0-10] 04 05 06 }  // Grouped concrete bytes
```

--------------------------------

### Replacing Regex with Offset Comparisons

Source: https://github.com/neo23x0/yara-performance-guidelines/blob/master/_autodocs/regular-expressions.md

Use explicit string definitions and offset comparisons instead of unbounded regex quantifiers for sequence matching.

```yara
strings:
    $slow = /exec.*\/bin\/sh/
condition:
    $slow
```

```yara
strings:
    $exec = "exec"
    $sh = "/bin/sh"
condition:
    $exec and $sh and @exec < @sh
```