Anonymous YARA Rules Are Not Anonymous

2026-05-26

AI Summary

This study demonstrates that merely stripping metadata from shared YARA rules is insufficient to preserve contributor anonymity. For the first time, it systematically reveals that YARA rules themselves constitute a quantifiable OPSEC attack surface, enabling adversaries to infer sensitive attributes—including author identity, source repository, malware family, and temporal drift—directly from rule content. Leveraging stylistic analysis through lexical n-grams (Burrows’ Delta), syntactic abstract syntax tree (AST) features (Caliskan-Islam), and a fine-tuned CodeBERT model, the authors achieve 76% accuracy in re-identifying rule authors even after controlling for malware family, alongside 99% accuracy in identifying the originating repository and 95% accuracy in malware family classification. These results expose significant privacy risks in current YARA rule anonymization practices.

Abstract

YARA rules are widely shared across threat intelligence communities to enable collective defence against malware. This practice implicitly assumes that removing metadata (e.g., author fields) sufficiently protects the identity of contributing organisations. To assess the validity of this assumption, we systematically evaluate how much can be inferred from YARA rule text alone. Specifically, using a corpus of 23,305 rules from three major public repositories, we train independent classifiers along four stylometric fingerprint dimensions: individual author, source repository, malware family, and temporal drift, using three complementary methods: lexical n-grams (Burrows' Delta), syntactic AST features (Caliskan-Islam), and fine-tuned CodeBERT. Our results demonstrate that repository origin is almost perfectly recoverable (up to 99% accuracy), individual authors can be re-identified well above chance (76%), and malware family classification reaches 95%. Comparing the same repository attribution task across full-history and time-restricted subsets reveals a 9-18% accuracy gap, providing preliminary evidence of temporal drift in repository fingerprints.To further disentangle content from style, we conduct per-malware family author attribution experiments. Even when the malware family is the same for all samples considered, authors can still be re-identified for five of seven tested families (mean accuracy 74.6%). These findings constitute the first systematic demonstration that YARA rule sharing is a measurable OPSEC attack surface, and that metadata removal alone does not mitigate it.

Problem

• YARA rules
• anonymity
• stylometric analysis
• attribution
• OPSEC

Innovation

• stylometric analysis
• YARA rules
• authorship attribution
• OPSEC leakage
• CodeBERT