Using YARA rules in ClamAV

ClamAV version 0.99 and above can process YARA rules. ClamAV virus database file names ending with “.yar” or “.yara” are parsed as yara rule files. The link to the YARA rule grammar documentation may be found at http://plusvic.github.io/yara/. There are currently a few limitations on using YARA rules within ClamAV:

In addition, there are a few more ClamAV processing modes that may affect the outcome of YARA rules.

  rule CheckFileSize
  {
    strings:
      $abc = "abc"
    condition:
      ($abc or not $abc) and filesize < 200KB
  }

This will ensure that the YARA condition always performs the desired action (checking the file size in this example),