yara.json

{
    "Import": {
        "prefix": "import",
        "body": "import \"${1|pe,elf,cuckoo,magic,hash,math,dotnet,time|}\"",
        "description": "Import a YARA module"
    },
    "for..of": {
        "prefix": "for..of",
        "body": [
            "for ${1:any} of ${2:them} : (",
             "\t${3:boolean_expression}",
             ")"
        ],
        "description": "Apply the same condition to many strings"
    },
    "for..in": {
        "prefix": "for..in",
        "body": [
            "for ${1:any i} in ( ${2:them} ) : (",
            "\t${3:boolean_expression}",
            ")"
        ],
        "description": "Loop over items"
    },
    "any": {
        "prefix": "any",
        "body": "any of ${them}",
        "description": "String set keyword: any"
    },
    "all": {
        "prefix": "all",
        "body": "all of ${them}",
        "description": "String set keyword: all"
    },
    "PE Header": {
        "prefix": "header_pe",
        "body": "uint16(0) == 0x5A4D ",
        "description": "Generate a condition to check for a PE file header"
    },
    "ELF Header": {
        "prefix": "header_elf",
        "body": "uint32(0) == 0x464C457F ",
        "description": "Generate a condition to check for an ELF file header"
    },
    "Mach-O Header": {
        "prefix": "header_macho",
        "body": "uint32(0) == 0xFEEDFACF ",
        "description": "Generate a condition to check for a Mach-O file header"
    }
}