It's all about the structure! Creating YARA rules by clicking

VirusTotal announces a YARA rule–authoring workflow that combines a syntax-aware editor with a new Structure view exposing the full JSON of files, URLs, domains, and IPs, letting analysts click fields (behavior, metadata, MITRE ATT&CK, ITW, WHOIS, headers, ASN, categories, etc.) to auto-generate correct vt module conditions and loops for LiveHunt rules. The post outlines practical hunting use cases across object types (e.g., file writes, URL patterns, registry/ASN filtering, phishing categorization, certificate dates, favicons) and invites community contributions via a public GitHub repository.