I have a yara rule that looks for multiple strings in a file and fires if the count is greater than 3. But how would I change the condition statement to only fire if greater than 3 but less than 5?

Essentially I want something like this

3 < (#var_*) < 10

But this statement is not valid syntax. Is there a way to use the count operator # with a wildcard *?

rule strings
        notes = "testing"
        var_01 = "string1"
        var_02 = "string2"
        var_03 = "string3"
        var_04 = "string4"
        var_05 = "string5"
        var_06 = "string6"
        var_07 = "string7"
        var_08 = "string8"
        3 of ($var_*)
  • What you want would require a parser of the parser since you are talking about variable names. You are also creating a confusing bit of logic for the parser. Do you mean 3 of each? 3 of one? 3 of a combination? I think the best course of action is just to spell it all out.
    – schroeder
    Commented Aug 13, 2019 at 15:50
  • @bigC5012 You'd better ask this on stackoverflow
    – user211258
    Commented Aug 13, 2019 at 15:51
  • Not all applications do interpret the * symbol as a wildcard, symbols like this can have other functionalities such as multiplying
    – user211258
    Commented Aug 13, 2019 at 16:09
  • thanks for the help. I'll go ahead and post over on stackoverflow. The logic i'm looking for is the presence of any of the strings but only if greater than a certain value and less than a certain value. So this currently works if any 1 string fires 3 times or 3 separate strings fire at least 3 times. The problem is I do not want this to fire if the occurrence is greater than a value.
    – bigC5012
    Commented Aug 13, 2019 at 16:53

1 Answer 1


Your rule condition will match if at least 3 of the string found, not the count of all the string found. Because Yara doesn't mix the wildcard identifier(*) with counts(#), you can only use regex to simplified the count.

rule countstr
        $a1 = /(string1|string2|string3|string4|string5|string6|string7|string8)/
        #a1 > 3 and #a1 < 10

Bear in mind that regex cannot compete with plain string matching. For performance concern, you need to resort to something like the following.

rule countstr2
        $a1 = "string1"
        $a2 = "string2"
        $a3 = "string3"
        $a4 = "string4"
        $a5 = "string5"
        $a6 = "string6"
        $a7 = "string7"
        $a8 = "string8"
        (#a1+#a2+#a3+#a4+#a5+#a6+#a7+#a8) > 3 and (#a1+#a2+#a3+#a4+#a5+#a6+#a7+#a8) < 10

Not the answer you're looking for? Browse other questions tagged .