Writing YARA Rules for AI Threat Detection

I built a YARA detection engine that scans LLM conversations for attack patterns in production. Here's why and what I learned.

YARA has been the standard for malware classification for over a decade. Security teams worldwide use it to scan files, memory, and network traffic for known threat signatures. The rules are portable, version-controlled, and run anywhere — Python, command line, Splunk, any SIEM.

But nobody was using it for AI.

LLMs face a growing list of attacks — prompt injection, jailbreaks, system prompt extraction, data exfiltration, tool abuse — and there's no standardized detection format for any of them. The malware world solved this problem years ago. The AI security world hasn't caught up yet.

So I built a YARA detection engine specifically for AI threat patterns and integrated it into AgentShield, my AI agent security platform.

Why YARA Works for AI Threats

AI attacks follow recognizable patterns in conversation text. A prompt injection attempt has specific linguistic signatures. A system prompt extraction attack uses predictable phrasing. A jailbreak follows known structural templates.

If you can define the pattern, YARA can detect it.

The same rule format that catches malware in binaries works for catching adversarial prompts in LLM conversations. The difference is what you're scanning — instead of file bytes, you're scanning multi-turn conversation logs and tool call payloads.

What I Built

I designed and implemented a detection engine that runs as a module inside AgentShield's audit pipeline. After injection testing collects conversation data from a target model, the YARA scanner evaluates every conversation turn against the full ruleset. When a rule matches, it logs the severity, attack category, and framework mapping.

The key architectural decisions:

How a Rule Works

A YARA rule has three sections: a name that identifies it, strings that define the patterns to match, and conditions that control when the rule fires. For AI threat detection, the strings section contains linguistic patterns associated with known attack techniques, and the meta section carries the classification metadata.

For example, a basic prompt injection detection rule would define string patterns for common injection phrases, set a condition like "any of them" to trigger on any match, and include meta fields mapping to OWASP LLM01 (Prompt Injection) and the corresponding MITRE ATLAS technique. The nocase modifier handles the fact that attackers vary capitalization to evade simple string matching.

rule prompt_injection_basic {
  meta:
    severity = "high"
    owasp = "LLM01"
    mitre_atlas = "AML.T0051"

  strings:
    $a1 = "ignore previous instructions" nocase
    $a2 = "disregard your system prompt" nocase
    $a3 = "you are now a new AI" nocase

  condition:
    any of them
}

That's a basic example. The more interesting rules detect multi-turn manipulation patterns, encoding-based evasion, and indirect injection techniques where the attack is embedded in data rather than typed directly by the user.

Production Results

I've run the engine against multiple production LLMs as part of full enterprise security audits. Without getting into model-specific findings, I can share that the scanner consistently identifies real attack patterns that the injection testing module confirms as successful exploits. The detection categories that light up most frequently are system prompt extraction, data exfiltration, and jailbreak techniques.

The detection results feed into AgentShield's PDF audit reports alongside injection test results, compliance mapping, and remediation recommendations — giving customers a complete picture of where their model's defenses break down and which specific attack patterns succeed.

The Difference Between Testing and Detection

This is the distinction that matters most. Injection testing tells you a model is vulnerable to an attack category. YARA detection tells you which specific pattern succeeded, classifies it against industry frameworks, and maps it to a severity level.

For enterprise security teams, that classification is what enables triage, prioritization, and structured reporting. YARA rules integrate into the same workflows SOCs already use for traditional threat detection — the output format is familiar even though the threat domain is new.

What I Learned