Yara Python Packages

plyara

Parse YARA rules and operate over them more easily.

iocextract

Defanged Indicator of Compromise (IOC) Extractor.

apkid

Android Application Identifier for Packers, Protectors, Obfuscators and Oddities - PEiD for Android

torikago

Torikago (鳥籠) — static triage for an unknown executable. Identifies, unpacks and reports indicators, and never runs the target.

boreal-python

Safe and performant YARA rules evaluator in Rust

pdfalyzer

Analyze PDFs with colors (and YARA)

threatingestor

Extract and aggregate threat intelligence.

yaraast

A powerful Python library and CLI tool for parsing, analyzing, and manipulating YARA rules through Abstract Syntax Tree (AST) representation

gokdogan-triage

Static PE malware triage engine — imphash/entropy/packer/strings/capabilities/YARA + MITRE ATT&CK, weighted verdict. No sample execution, offline core.

1200km-aidebug

Evidence-focused malware reverse engineering with deep PE/.NET inspection, Ghidra reconstruction, AI cross-checks, YARA, and ELF debugging

yaralyzer

Visually inspect and force decode YARA and regex matches found in both binary and text data with colors. Lots of colors.

ts-scan

One scanner integrating several capabilities across different environments

fibratus

Security sensor for realtime threat detection and protection

yarobot

Simple YARA rules generator with web interface, API, and cli

autopyara

Python Package of AutoPYara

yara-mail

A Python package and command line utility for scanning emails with YARA rules

wpguard

Scan, clean, harden, back up and monitor hacked WordPress sites with wp-cli: signature/YARA/behavior scanning, reversible quarantine, encrypted backups, file-integrity watch

yaratool

Python libary to normalize Yara signatures

malwagon

Scan a file for malware from your terminal. Automated malware analysis sandbox CLI with hypervisor-level agentless dynamic analysis, BYOVD kernel driver analysis and AI-assisted reporting. pip install malwagon

ludvig

Security scanner using YARA

phishsage

CLI toolkit for email phishing analysis. Parses .eml files, runs heuristic checks on headers, links, and attachments, and outputs structured JSON.

pyhids

A HIDS (host-based intrusion detection system) for verifying the integrity of a system.

crossfire-rules

Regex rule overlap analyzer for DLP, secret scanning, SAST, and IDS tools

ransomtriage

Offline, privacy-preserving first-hour ransomware triage: identify the family, extract IOCs, find verified free decryptors. Nothing is uploaded.