Skip to content

Instantly share code, notes, and snippets.

View mguerreiro's full-sized avatar

Maxime Guerreiro mguerreiro

View GitHub Profile

Keybase proof

I hereby claim:

  • I am mguerreiro on github.
  • I am mguerreiro (https://keybase.io/mguerreiro) on keybase.
  • I have a public key whose fingerprint is C307 00A1 C933 99E4 181E 5D96 6E5F 7F85 1ADF BCE7

To claim this, I am signing this object:

@mguerreiro
mguerreiro / yara_performance_guidelines.md
Created October 10, 2016 09:46 — forked from Neo23x0/yara_performance_guidelines.md
YARA Performance Guidelines

YARA Performance Guidelines

When creating your rules for YARA keep in mind the following guidelines in order to get the best performance from them. This guide is based on ideas and recommendations by Victor M. Alvarez and WXS.

  • Revision 1.1, February 2016, applies to all YARA version 3.3+

Global Rules

Global rules are evaluated first. Only if they are satisfied non-global rules are evaluated. This may be useful if all samples exhibit the same characteristics. Use them combined with the "private" statement to suppress a match notification on the global rules.