---
title: "Beware of the wildcard"
url: https://daily.dev/posts/beware-of-the-wildcard-cnnz5ig83
source_url: https://virustotal.github.io/yara-x/blog/beware-of-the-wildcard
type: article
source: "YARA-X"
published: 2026-08-23T12:23:27.315Z
updated: 2026-08-23T12:59:47.219Z
tags: ["security", "malware"]
reading_time: 3
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Beware of the wildcard

**[YARA-X](https://daily.dev/sources/yara-x)** · 3 min read · 0 upvotes · 0 comments

## Summary

Wildcard pattern sets in YARA rules, such as `any of ($s*)` or `2 of ($b*)`, can silently create logic bugs when prefixes overlap—for example, `$bd1` and `$bd2` unintentionally satisfying a `2 of ($b*)` condition meant for `$b1` through `$b5`. This kind of collision turns out to be common in real-world VirusTotal rules. A new compiler warning called `unintended_pattern_in_set` has been built for YARA-X to catch these overlapping prefix issues automatically, and it will ship in the upcoming YARA-X v1.20.0 release.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://virustotal.github.io/yara-x/blog/beware-of-the-wildcard>

## Questions this post answers

### Why does my YARA rule with `2 of ($b*)` and `1 of ($bd*)` not behave as expected?

The wildcard `$b*` matches every pattern starting with `$b`, including `$bd1` and `$bd2`, not just the intended `$b1` through `$b5`. If both `$bd1` and `$bd2` are present, they alone satisfy `2 of ($b*)`, making the `$b1`-`$b5` patterns unnecessary; if only one is present, just a single `$b1`-`$b5` match is needed instead of two.

_daily.dev surfaces write-ups like this for teams hardening detection rule logic before it ships._

### What new compiler warning is coming in YARA-X v1.20.0?

YARA-X v1.20.0 will introduce an unintended_pattern_in_set compiler warning that detects overlapping wildcard prefixes and pattern set collisions, such as a variable like $this being unintentionally matched by a wildcard set like $t*. This catches silent logic bugs in rule conditions that previously required manual inspection to find.

_Track upcoming YARA-X releases like this one on daily.dev before rolling out rule changes._

---

Tags: [#security](https://daily.dev/tags/security), [#malware](https://daily.dev/tags/malware)

[View this post on daily.dev](https://daily.dev/posts/beware-of-the-wildcard-cnnz5ig83)