YARA-X 1.22.0 Released: Why Detection Engineers Should Upgrade Their Malware Scanning Pipeline Now

---
title: Unauthorized Modification or Deletion of YARA Rule Files
id: 3f9c2a71-6b48-4e15-9d27-8a1c5e42f093
status: experimental
description: Detects creation, modification, or deletion of YARA rule files outside of authorized detection-engineering change windows. Adversaries with endpoint access may tamper with rulesets to blind YARA/YARA-X scanning pipelines (T1562.001).
references:
  - https://attack.mitre.org/techniques/T1562/001/
  - https://github.com/VirusTotal/yara-x
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: file_event
  product: windows
detection:
  selection_ext:
    TargetFilename|endswith:
      - '.yar'
      - '.yara'
  filter_legit_paths:
    TargetFilename|contains:
      - '\git\'
      - '\.git\'
  condition: selection_ext and not filter_legit_paths
falsepositives:
  - Detection engineers editing rules outside version control (should be investigated as process deviation)
  - Automated ruleset sync tooling — whitelist its service account and path
level: medium
---
title: YARA Scanner Process Terminated or Rules Deleted via Command Line
id: 8c4d1b96-2e73-4a58-bf60-1d9e7c35a842
status: experimental
description: Detects command-line activity that terminates YARA/YARA-X scanning processes or deletes rule files, consistent with an adversary impairing host-based scanning before staging payloads.
references:
  - https://attack.mitre.org/techniques/T1562/001/
  - https://attack.mitre.org/techniques/T1070/004/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.defense_evasion
  - attack.t1562.001
  - attack.t1070.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_kill:
    CommandLine|contains:
      - 'taskkill'
      - 'Stop-Process'
  selection_target:
    CommandLine|contains:
      - 'yr.exe'
      - 'yara'
      - 'yara-x'
  selection_delete:
    CommandLine|contains:
      - 'del '
      - 'Remove-Item'
      - 'rm '
  selection_delete_ext:
    CommandLine|contains:
      - '.yar'
  condition: (selection_kill and selection_target) or (selection_delete and selection_delete_ext)
falsepositives:
  - SOC automation restarting the scanner during ruleset deployment — correlate with change tickets
level: high

// Hunt: YARA rule tampering and scanner interference across Windows and Linux endpoints
// Covers rule-file modification by non-engineering accounts and deletion/kill of scanner processes.
let EngineeringAccounts = dynamic(["detection.eng@", "soc-automation@"]); // populate with your rule-deploy identities
let RulePaths = dynamic(["\\rules\\", "/opt/yara/", "/etc/yara/", "yara-rules"]);
union isfuzzy=true
(DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FileName endswith ".yar" or FileName endswith ".yara"
| where FolderPath has_any (RulePaths)
| where not(InitiatingProcessAccountName has_any (EngineeringAccounts))
| project TimeGenerated, DeviceName, ActionType, FolderPath, FileName,
          InitiatingProcessAccountName, InitiatingProcessCommandLine
| extend Source = "DefenderFileEvents"),
(DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where ProcessCommandLine has_any ("taskkill", "Stop-Process", "pkill", "killall")
  and ProcessCommandLine has_any ("yara", "yr scan", "yara-x")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine
| extend Source = "DefenderProcessEvents"),
(Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any (".yar", "yara", "yara-x")
  and SyslogMessage has_any (" rm ", "unlink", "pkill", "killall")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| extend Source = "Syslog")
| order by TimeGenerated desc

-- Artifact: SecurityArsenal.YaraRuleset.Audit
-- Purpose: Inventory YARA rule files and recent modifications across an endpoint
-- to surface unauthorized tampering of detection rulesets (T1562.001).
-- Deploy as a Velociraptor hunt; tune rule_dirs to your deployment paths.

LET rule_dirs = SELECT * FROM foreach(row=[
  'C:/ProgramData/yara/**',
  'C:/tools/yara/**',
  '/opt/yara/**',
  '/etc/yara/**',
  '/usr/local/share/yara/**'
])

LET rules = SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=[
  'C:/ProgramData/yara/**/*.yar',
  'C:/tools/yara/**/*.yar*',
  '/opt/yara/**/*.yar*',
  '/etc/yara/**/*.yar*',
  '/usr/local/share/yara/**/*.yar*'
])

SELECT FullPath,
       Size,
       Mtime,
       Btime,
       hash(path=FullPath).SHA256 AS RuleSHA256,
       timestamp(epoch=now() - Mtime.Unix) AS ModifiedAgo
FROM rules
WHERE Mtime.Unix > now() - 86400 * 7   -- modified in the last 7 days
ORDER BY Mtime DESC

#!/usr/bin/env bash
# yara-x-upgrade.sh — Upgrade YARA-X to 1.22.0 and validate the production ruleset.
# Run on scanning hosts, sandbox workers, and DFIR triage boxes. Test in staging first.
set -euo pipefail

TARGET_VERSION="1.22.0"
RULES_DIR="${RULES_DIR:-/opt/yara/rules}"   # adjust to your ruleset path
STAGING_DIR="$(mktemp -d)"

echo "[*] Current YARA-X version:"
yr --version || { echo "[!] yr not found on PATH"; exit 1; }

echo "[*] Downloading YARA-X ${TARGET_VERSION} release artifacts..."
cd "$STAGING_DIR"
curl -fLO "https://github.com/VirusTotal/yara-x/releases/download/v${TARGET_VERSION}/SHA256SUMS"
# Select the correct asset for your platform from:
#   https://github.com/VirusTotal/yara-x/releases/tag/v1.22.0
# Example (Linux x86_64, verify exact asset name on the release page):
#   curl -fLO "https://github.com/VirusTotal/yara-x/releases/download/v${TARGET_VERSION}/yara-x-v${TARGET_VERSION}-x86_64-unknown-linux-gnu.gz"

echo "[*] Verify checksum BEFORE installing — never skip this on a supply chain this sensitive:"
grep linux SHA256SUMS   # confirm the downloaded asset's hash matches

# After verifying, install per the project's README, e.g.:
#   gunzip yara-x-v${TARGET_VERSION}-x86_64-unknown-linux-gnu.gz
#   install -m 0755 yara-x-v${TARGET_VERSION}-x86_64-unknown-linux-gnu /usr/local/bin/yr

# Alternative for Python pipelines:
#   pip install --upgrade "yara-x==1.22.0"

echo "[*] Post-upgrade version check:"
yr --version

echo "[*] Validating production ruleset compiles under ${TARGET_VERSION}..."
# Compile/scan a canary file with every production rule to surface newly-strict compiler errors.
CANARY="$(mktemp)"
echo "SecurityArsenal canary" > "$CANARY"
FAILURES=0
for rule in "$RULES_DIR"/*.yar "$RULES_DIR"/*.yara; do
  [ -e "$rule" ] || continue
  if ! yr scan "$rule" "$CANARY" >/dev/null 2>"$rule.err"; then
    echo "[!] Rule failed under 1.22.0: $rule"
    sed 's/^/    /' "$rule.err"
    FAILURES=$((FAILURES+1))
  fi
  rm -f "$rule.err"
done

echo "[*] Positive-control test — confirm engine still fires on a known-bad test rule:"
cat > "$STAGING_DIR/eicar_test.yar" <<'EOF'
rule EICAR_Control {
    strings:
        $s = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*"
    condition:
        $s
}
EOF
printf 'X5O!P%%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > "$STAGING_DIR/eicar.txt"
yr scan "$STAGING_DIR/eicar_test.yar" "$STAGING_DIR/eicar.txt" && echo "[+] Engine fires correctly" || echo "[!] ENGINE FAILED POSITIVE CONTROL"

echo "[*] Done. Ruleset failures: $FAILURES"
rm -rf "$STAGING_DIR"
[ "$FAILURES" -eq 0 ] && exit 0 || exit 2