findcrypt-yara
An IDA Pro plugin that uses YARA rules to automatically detect cryptographic constants and patterns in binary files during reverse engineering analysis.
An IDA Pro plugin that uses YARA rules to automatically detect cryptographic constants and patterns in binary files during reverse engineering analysis.
Checked October 2026.
findcrypt-yara is an IDA Pro plugin designed to identify cryptographic constants and related patterns within binary files during reverse engineering analysis.
The plugin leverages YARA rules to detect various cryptographic implementations, algorithms, and constants that may be present in executable files. It integrates directly into the IDA Pro disassembler environment, allowing analysts to automatically scan loaded binaries for cryptographic signatures.
Installation requires the yara-python package to be installed via pip. The plugin supports custom rule files that can be stored in designated directories based on the operating system being used.
The tool assists reverse engineers and malware analysts in quickly identifying cryptographic routines within binary samples, which can be crucial for understanding encryption mechanisms, key derivation functions, and other security-related implementations in analyzed software.
No core features are listed for this product yet, so check the vendor's documentation for the full feature list.
No integrations are listed for this product yet. Check the vendor's documentation, or ask the vendor which integrations and APIs it supports.
Common questions about findcrypt-yara: features, pricing and alternatives.
findcrypt-yara is a product in the Detection Engineering category. It covers Reverse Engineering, Binary Analysis and YARA.
findcrypt-yara is free. Download and setup instructions are at https://github.com/polymorf/findcrypt-yara/.
Alternatives to findcrypt-yara listed on CybersecTools:
Compare all findcrypt-yara alternatives at https://cybersectools.com/alternatives/findcrypt-yara
findcrypt-yara is available as on-premises software. It is listed for mid-market companies and enterprises. It is free.
Side by side: features, pricing model and the company behind each one.
Open-source Azure workbook for visualizing and tuning Sentinel detection performance
SOC resilience platform detecting & repairing drift in detection rules and pipelines.
FSF is a modular, recursive file scanning solution that enables analysts to extend the utility of Yara signatures and define actionable intelligence within a file.
Use FindYara, an IDA python plugin, to scan your binary with yara rules and quickly jump to matches.
FireEye Mandiant SunBurst Countermeasures: freely available rules for detecting malicious files and activity
A set of rules for detecting threats in various formats, including Snort, Yara, ClamAV, and HXIOC.
On our shortlist?
No shortlist covers this product's category yet. The closest is Best MDR Solutions for Business.
Get a summary of this page from your assistant.
Mandos MCP: ask about all 9,032 products.
Connect your AI
