yara.json

{
    "Rule": {
        "prefix": "rule",
        "body": [
            "rule ${1:$TM_FILENAME_BASE}",
            "{",
            "\tmeta:",
            "\t\tdescription = \"${description}\"",
            "\t\tauthor = \"${author}\"",
            "\t\tdate = \"${CURRENT_YEAR}-${CURRENT_MONTH}-${CURRENT_DATE}\"",
            "\t\treference = \"${reference}\"",
            "\t\thash = \"${hash}\"",
            "\tstrings:",
            "\t\t$${name} = \"${string}\"",
            "\tcondition:",
            "\t\t${condition}",
            "}"
        ],
        "description": "Generate a rule skeleton"
    },
    "Meta": {
        "prefix": "meta",
        "body": [
            "meta:",
            "\tdescription = \"${description}\"",
            "\tauthor = \"${author}\"",
            "\tdate = \"${CURRENT_YEAR}-${CURRENT_MONTH}-${CURRENT_DATE}\"",
            "\treference = \"${reference}\"",
            "\thash = \"${hash}\""
        ],
        "description": "Generate a 'meta' section"
    },
    "Strings": {
        "prefix": "strings",
        "body": [
            "strings:",
            "\t$${name} = \"${string}\""
        ],
        "description": "Generate a 'strings' section"
    },
    "Condition": {
        "prefix": "condition",
        "body": [
            "condition:",
            "\t${conditions}"
        ],
        "description": "Generate a 'condition' section"
    },
    "Import": {
        "prefix": "import",
        "body": "import \"${1|pe,elf,cuckoo,magic,hash,math,dotnet,time|}\"",
        "description": "Import a YARA module"
    },
    "for": {
        "prefix": "for",
        "body": "for ${1:expression} of ${2:string_set} : ( ${3:boolean_expression} )",
        "description": "Apply the same condition to many strings"
    },
    "any": {
        "prefix": "any",
        "body": "any of ${them}",
        "description": "String set keyword: any"
    },
    "all": {
        "prefix": "all",
        "body": "all of ${them}",
        "description": "String set keyword: all"
    }
}