Beware of the wildcard
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
Wildcard pattern sets in YARA rules, such as `any of ($s*)` or `2 of ($b*)`, can silently create logic bugs when prefixes overlap—for example, `$bd1` and `$bd2` unintentionally satisfying a `2 of ($b*)` condition meant for `$b1` through `$b5`. This kind of collision turns out to be common in real-world VirusTotal rules. A new compiler warning called `unintended_pattern_in_set` has been built for YARA-X to catch these overlapping prefix issues automatically, and it will ship in the upcoming YARA-X v1.20.0 release.
Questions this post answers
Why does my YARA rule with `2 of ($b*)` and `1 of ($bd*)` not behave as expected?
The wildcard `$b*` matches every pattern starting with `$b`, including `$bd1` and `$bd2`, not just the intended `$b1` through `$b5`. If both `$bd1` and `$bd2` are present, they alone satisfy `2 of ($b*)`, making the `$b1`-`$b5` patterns unnecessary; if only one is present, just a single `$b1`-`$b5` match is needed instead of two. daily.dev surfaces write-ups like this for teams hardening detection rule logic before it ships.
What new compiler warning is coming in YARA-X v1.20.0?
YARA-X v1.20.0 will introduce an unintended_pattern_in_set compiler warning that detects overlapping wildcard prefixes and pattern set collisions, such as a variable like $this being unintentionally matched by a wildcard set like $t*. This catches silent logic bugs in rule conditions that previously required manual inspection to find. Track upcoming YARA-X releases like this one on daily.dev before rolling out rule changes.