YARA Rules

A YARA rule is how you describe a family rather than a file, and saving one in Stairwell runs it across everything already collected.

If you have never written one, Writing Your First YARA Rule assumes nothing. If you have, YARA Rule Best Practices is the page to read when a rule works but matches far too much.