// the take
yarGen generates draft YARA rules for malware triage by extracting strings and opcodes from a sample and stripping out anything that also shows up in a large bundled goodware database. It's by Florian Roth (Sigma, LOKI/THOR), widely used in DFIR/malware-research circles, but the README itself flags it as not maintained in favor of a Go rewrite (yarGen-Go).
Goodware-string suppression is the right idea done properly — it catches common CRT/compiler strings that look 'unique' but aren't, which is where a lot of hand-written YARA rules go wrong. Super-rule generation (merging overlapping strings across several samples of the same family) is a genuine time-saver during triage of a batch of variants. The extra signal sources — opcode extraction from .text sections, imphash/export conditions, a naive-bayes classifier to filter out compressed/encrypted garbage — show real domain knowledge, not just string matching with extra flags.
Explicitly unmaintained; the author points new users to yarGen-Go instead, so anything broken here stays broken. Resource use is heavy and stuck that way — 3-6GB RAM just to load the goodware DB, and the README says a SQLite migration was tried and scrapped for being too slow, so this isn't going to get lighter. Output is draft-quality by design: both the README and the linked video tutorial stress that generated rules need manual string cleanup before use, which is easy to skip if you're treating this as push-button automation. The bundled 913MB goodware database is an opaque blob with no documented composition or freshness, so you're trusting false-positive suppression you can't inspect.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →