# How to Use the Malware Analysis Skill with YARA Rules: A Six-Stage Workflow

> Master malware analysis with YARA rules using a six-stage workflow. Validate static binaries, enrich results with CAPE sandbox, and store IOC data. Learn this powerful technique today.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-06

---

**The malware-analysis skill orchestrates a complete six-stage investigation pipeline that validates YARA rules against static binaries and dynamically enriches results through the CAPE sandbox, storing all matches as structured IOC data.**

The `reverse-skill` repository by zhaoxuya520 implements a comprehensive malware analysis framework that integrates YARA rule scanning into a reproducible, auditable workflow. This guide explains how to use the malware analysis skill with YARA rules to move from rule conception to detection, leveraging both static analysis and dynamic sandbox execution against malicious samples.

## Understanding the Six-Stage YARA Workflow Architecture

According to [`skills/malware-analysis/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/SKILL.md), the **malware-analysis skill** implements a six-stage investigation pipeline specifically designed for YARA-driven detection. When YARA rules are required, the skill enforces a strict architecture that validates rules before execution and correlates results with the MITRE ATT&CK framework.

### Phase 1: Preparation Following YARA + Sigma Methodology

The workflow begins with rule authoring guided by [`skills/malware-analysis/references/yara-sigma-rules.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/references/yara-sigma-rules.md). This document defines the **YARA + Sigma** methodology, ensuring rules are compatible with both static scanners and the CAPE sandbox. Rules must include proper metadata and string definitions to support later IOC extraction.

Example rule structure following the methodology:

```yaml
rule SuspiciousPE
{
    meta:
        description = "Detects packed PE files"
        author      = "analyst@example.com"
    strings:
        $a = {E8 ?? ?? ?? ?? 83 C4 04 5B}
    condition:
        $a
}

```

### Phase 2: Rule Validation Using Python Bindings

Before any scanning occurs, the "YARA 规则验证" (YARA Rule Validation) section in [`skills/malware-analysis/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/SKILL.md) mandates validation using the Python YARA bindings. Install the required dependency:

```bash
pip install yara-python

```

Validate and compile rules programmatically to catch syntax errors:

```python
import yara

# Load and compile the rule (replace path with your rule file)

rules = yara.compile(filepath="suspicious_pe.yar")

# Scan a binary file

matches = rules.match(filepath="sample.exe")
if matches:
    print("YARA match found:", matches)
else:
    print("No match")

```

### Phase 3: Static Scanning Against Binaries

Once validated, the skill applies rules to target binaries using either the Python API or the command-line `yara` tool. All matches are immediately stored as **Indicator-of-Compromise (IOC)** data for inclusion in the final analysis report. This static phase extracts initial evidence before any dynamic execution.

### Phase 4: Dynamic Enrichment via CAPE Sandbox

For samples requiring behavioral analysis, the skill invokes the **CAPE sandbox**, which features native YARA support. As documented in [`skills/malware-analysis/references/sandbox-orchestration.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/references/sandbox-orchestration.md), the "YARA 规则扫描" (YARA Rule Scanning) functionality automatically loads the same rule set validated in Phase 2:

```bash

# Launch CAPE with the YARA rule set

cape -r suspicious_pe.yar -i sample.exe

```

CAPE applies the rules during runtime execution and reports any hits in its JSON output, enabling detection of unpacked or decrypted strings that may not be visible in static analysis.

### Phase 5: Result Correlation with MITRE ATT&CK

The final phases merge static and dynamic matches using the "YARA → MITRE 映射" (YARA to MITRE Mapping) guidelines in [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md). Detected indicators are mapped to specific MITRE ATT&CK techniques, providing tactical context for the final report. The "Phase 4: YARA 规则编写" section details how to structure rules to facilitate this automatic correlation.

## Key Reference Files in the Repository

Understanding the repository structure is essential for implementing this workflow:

- **[`skills/malware-analysis/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/SKILL.md)** — Contains the core skill definition, the six-stage workflow breakdown, and the "YARA 规则验证" validation requirements.
- **[`skills/malware-analysis/references/yara-sigma-rules.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/references/yara-sigma-rules.md)** — Provides the detailed methodology for authoring YARA and Sigma rules according to the skill's standards.
- **[`skills/malware-analysis/references/sandbox-orchestration.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/references/sandbox-orchestration.md)** — Documents CAPE integration, specifically how the "YARA 规则扫描" feature injects rules into dynamic analysis.
- **[`skills/malware-analysis/references/anti-analysis-techniques.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/references/anti-analysis-techniques.md)** — Offers context on common evasion techniques, essential for writing YARA rules that detect anti-analysis behaviors.

## Summary

- The **malware-analysis skill** implements a strict six-stage pipeline for YARA-based investigation in `reverse-skill`.
- Rules must follow the **YARA + Sigma methodology** documented in [`yara-sigma-rules.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/yara-sigma-rules.md) to ensure compatibility.
- **Validation is mandatory** using `yara-python` before any scanning occurs, as specified in the "YARA 规则验证" section.
- **Static analysis** uses the Python API or CLI tool, while **dynamic analysis** leverages CAPE's native YARA integration.
- All detections are **correlated with MITRE ATT&CK techniques** via the "YARA → MITRE 映射" process and stored as structured IOC data.

## Frequently Asked Questions

### What Python library is required for YARA rule validation in this skill?

The skill requires the **`yara-python`** package, installable via `pip install yara-python`, to compile and validate rules before deployment. This requirement is explicitly defined in the "YARA 规则验证" section of [`skills/malware-analysis/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/SKILL.md).

### How does the malware-analysis skill correlate YARA matches with threat intelligence?

The skill implements a "YARA → MITRE 映射" (YARA to MITRE Mapping) phase that automatically maps detection strings and rule conditions to specific MITRE ATT&CK techniques, enriching the final report with tactical context and TTP classifications.

### Can the same YARA rules be used for both static and dynamic analysis?

Yes. The workflow validates rules once using Python bindings for static scanning, then reuses the identical rule set during CAPE sandbox execution. The [`skills/malware-analysis/references/sandbox-orchestration.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/references/sandbox-orchestration.md) file documents how CAPE automatically loads these rules for runtime detection.

### Where should analysts store custom YARA rules when using this skill?

While the skill accepts any file path via the `filepath` parameter in Python or the `-r` flag in CAPE, the methodology in [`skills/malware-analysis/references/yara-sigma-rules.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/references/yara-sigma-rules.md) provides organizational guidelines for rule storage within the malware-analysis skill context, ensuring compatibility with both static scanners and the CAPE integration.