Run a YARA rule pack#

The rules sidebar on the left of the YARA tab, headed YARA-X, is the control surface for scanning. This page covers what is in the sidebar and what happens when you run a rule.

Rule packs#

A rule pack is a .yar file with one or more rules inside. The default packs ship with GraphDagger and load the first time the tab opens. Custom packs are ones you have added.

Each pack row shows the pack name, a count of the rules inside it, and a match-count badge after you run it. Click the chevron to expand the pack. It reveals the individual rules and, under each rule, its matches.

Sidebar controls#

The buttons at the top of the sidebar add and refresh rules.

• The plus button starts a new rule from scratch in the editor.
• The folder button adds a custom rule pack from disk. Pick one or more .yar files. They join a custom group and persist across sessions.
• The refresh button reloads the rule packs from disk.

Each pack and each rule carries its own controls: a run control, a pencil to open the editor, and a bin to delete it.

Run a scan#

Run a pack to queue a scan of every rule in it against the active file. Run an individual rule to scan only that rule. The status banner at the top of the centre column shows progress while the scan runs. When it finishes, matches appear on the hex dump and the rule's row shows a match count.

Files over 50 MiB#

When the active file is over 50 MiB, a confirmation opens before the scan starts. It warns that a scan of a large file can take a while, and it lets you cancel.

Cancel a scan#

You can cancel a scan in progress from the status banner. The scan stops as soon as the engine reaches a safe boundary. GraphDagger keeps the matches it found before that point.