Question: how do yara rules work?
Answer: Instead of using HASH signatures, it uses text or binary strings that uniquely identify a malware sample. ... Using relatively simple rules, YARA goes over the files that it receives and looks for the strings defined in the rule and, if they match certain conditions, it tells you what rules match each file.