Answer originally posted by user1901982 in Super User - What is “YaraScanService” that shows up in macOS Mojave Beta (10.14) and macOS High Sierra (10.13.6)?
Copied here for convenience, as community wiki.
MRT/YaraScan is a MacOS prodvided antivirus-copyright tool. The reason for it's obscene memory usage is basically why OSX doesn't have a formal 'antivirus'.
More simply, YaraScan is one part of the 'volatility suite' here; https://www.volatilityfoundation.org/about
Do realise that a virus and illegally pirated material both are only detected by a 'signature' set of code paths and both often reliant on bugs, exploits and weak patching, so it's only to be expected that the strongest modern antivirus was grown from a copyright infringement detection tool.
YaraScan runs once after Mojave update, and then deletes itself. The reason it uses so much memory is because unless otherwise programmed (as in it's an opt-out), a process that has to scan an incredible amount of file's contents for an unknown sized file that might be encrypted into said searched files will use a large amount of inactive memory to store all scanned files for a limited amount of time incase they are needed again. Why? Because empty RAM is wasted RAM, I mean you still have to give it watts so why delete the stuff on it when something else doesn't want to be there? It takes 100x longer to get it back.
More importantly, if you Filevault or APFS, some of that data is encrypted and must be decrypted to be read. Many apps actually need launching and then scanning when they are loaded as many files can come together to form a threat in memory space as a single 'concurrent file'. Standard antivirus could not detect this until the application was already running, and at that stage it could have already damaged your system.
The amount of time is actively decided by Grand Central Dispatch in your mac and as soon as you attempt to use a program that needs that RAM it will clear it.