YARA rule
A rule format for identifying and classifying malware based on patterns — text strings, byte sequences, or conditions in a file. "Pattern matching for malicious code"; YARA rules are written by analysts to detect a whole malware family, not just one sample.
Mechanic: a YARA rule defines strings (text or hex byte sequences) and a logical condition (e.g. "if 3 of these 5 strings are present AND the file starts with MZ"). The tool then scans files/memory/processes and flags matches. The strength over a pure file hash (an IoC): a hash matches only ONE exact file, while a well-written YARA rule catches variants and whole families (they often share code fragments/strings) — more robust to small changes. Use case: malware analysis and classification, threat hunting (search for a family across the whole fleet), incident response, and email/file scanning. Created by VirusTotal. Complement: Sigma does the same thing but for logs/SIEM. An indispensable tool in a malware analyst's kit. Related to Sigma rule and indicator of compromise.