YARA

A rule consists of strings — text, hex sequences or regular expressions — and a condition specifying which combination counts as a match, often combined with file size or PE header data. The advantage over hash comparison is generalization: a hash matches exactly one file, while a well-written rule catches an entire family including future variants, since attackers change a lot but rarely everything. It's used in incident response, memory analysis and threat hunting, and rule sets are shared openly between security teams. The downside is false positives — an overly general rule fires on legitimate software. YARA-X is the Rust rewrite.