Conditions, Counts & Specificity

What is it?

The condition combines strings with boolean logic, counts (#a > 3), positional/context checks (at, in), and filesize guards. Specificity means requiring enough evidence that only the target matches.

Why it matters

One generic string is a false-positive machine; requiring a combination ('2 of ($a,$b,$c)') or a count raises the evidence bar so the rule fires on the real family and not on coincidence.

Where you see it

`condition: filesize < 200KB and 2 of ($s*) and $magic at 0` — small file, at least two family strings, and the right header at offset 0.

What normal looks like

Conditions that require multiple pieces of evidence and bound the context (filesize, position), so a match is meaningful.

What suspicious looks like

`condition: $a` on a single common string (fires on benign files), or no filesize/context guard so it matches unrelated large files.

How analysts investigate

Ask: does a single benign file satisfy this condition? If yes, add evidence (require N of the strings) or context (filesize, position) until only the target family matches.

Common beginner mistakes

A condition of one generic string that matches benign files.
No filesize/context bound, so the rule scans and matches unrelated files.

Require enough evidence

  weak:   condition: $a                 ← one common string → false positives
  strong: condition:
    filesize < 200KB
    and 2 of ($fam1, $fam2, $fam3)     ← multiple family markers
    and $magic at 0                     ← right file type/position
  more evidence + context = fewer false positives

Specificity — requiring several strings plus filesize/position context — is what controls YARA false positives.

Quick check

A rule with `condition: $common_str` floods on benign files. Best improvement?

A quick self-check — it doesn't affect your XP or progress.