How to disable or remove the YaraScanService (MRT.app)? Recently on MacOS 10.13.6 I have noticed high CPU usage and identified the process YaraScanService as consuming close to 90% CPU.

The Activity Monitor lists it under:

/System/Library/CoreServices/MRT.app/Contents/XPCServices/YaraScanService.xpc/Contents/MacOS/YaraScanService

as part of the MRT.app.

According to this thread and another one it appears to be some kind of Apple's built-in antivirus that is doing its scanning yet there doesn't seem to be a way to disable or remove it apart from killing it from the Activity Monitor or with pkill.

Any pointers on how to control it or stop/disable it?

I would assume that if you have dozens of gigabytes of zip, tar, bzip, rar, jar archives then yarascan will unpack them all to memory or disc in order to scan them, and there is absolutely no way to whitelist or exclude them.

The MRT.app is timestamped on 10-Aug-2018 along with a bunch of other folders (apparently the date when I accepted an Apple update). Most files inside the folder are timestamped 4-Jul-2018 and 8-Jul-2018, supposedly when the app was released by Apple.
As mentioned in this article YaraScanService is part of the MRT.app (Malware Removal Tool). If you are sure your system is not infected with malware and you don't want Apple to do automatic malware protection for you without asking your consent, then you can disable and/or remove the MRT service using these commands:

sudo launchctl stop com.apple.mrt
sudo launchctl remove com.apple.mrt


The corresponding .plist files are apparently located at:

/System/Library/LaunchDaemons/com.apple.MRTd.plist
/System/Library/LaunchAgents/com.apple.MRTa.plist


If the above method does not work for you (apparently the daemon can re-enable itself), then a more radical approach would be to disable SIP with csrutil disable from recovery mode, and remove executable permissions on the MRT and YaraScanService files with:

chmod -R -x+X /System/Library/CoreServices/MRT.app


Once you have changed the permissions it is recommended to re-enable SIP again with csrutil enable (from recovery mode).