Alternatives to YARA
Pattern-matching engine for identifying and classifying malware samples. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
YARA
Pattern-matching engine for identifying and classifying malware samples.
Replacements
Listings that take over the same core job as YARA.
YARA-X
Match files against rules describing suspicious binary patterns.
YARA-X is the modern implementation where development has moved, keeping the same BSD-3-Clause license and YARA-style rules while the original engine is in maintenance mode.
Also worth comparing
These listings name YARA as their own alternative, so the relationship runs both ways.
THOR Lite
A free multi-platform IOC and YARA scanner for checking systems for signs of compromise.
YARA is the open-source BSD-3-Clause pattern engine itself, so you write or supply rules and build scanning around it rather than getting a ready IOC scanner.
Similar software
Related functionality, not a direct replacement.
capa
Identify likely capabilities inside executable files.
ClamAV
An open source antivirus engine, used mostly for scanning mail servers and file shares rather than desktops.
VirusTotal
Online service that checks a URL or file against many antivirus engines and URL scanners.
REMnux
Linux toolkit for reverse engineering and analysing malicious software.
Chainsaw
Search Windows forensic records for suspicious activity.
Detect It Easy
A program that identifies file types, packers, compilers and protectors used in executables.
