← All Tools

YARA Rule Builder & Tester

Build YARA detection rules visually with a live preview, validate the syntax, and run a quick string-match test against pasted samples.

100% client-side. No samples, rules, or text are sent to any server. No storage, no cookies, no tracking.

Rule name *

Tags (space-separated)

Metadata

Strings

Condition *

Examples: any of them, all of them, 2 of ($s*), $s1 and $s2, filesize < 1MB and any of them.

YAR Preview

Quick Tester

Paste a sample (log line, command line, decoded payload, etc.). The tester scans the UTF-8 byte view of your sample. It is honest: each string shows HIT, MISS, or NOT EVALUATED (with the reason), and the condition shows MATCH, no match, or not evaluated. It never fakes a verdict.

What the tester can and cannot evaluate

Evaluated faithfully: text strings (with ascii, wide, nocase, fullword), regex strings via the browser's JavaScript engine (with nocase), and hex strings made only of concrete byte pairs. Conditions built from and/or/not, $id, #id > N, and all/any/N of (…) / of them.

Shown as "not evaluated" (never faked): the xor, base64 and base64wide transforms; hex strings with wildcards, jumps or alternations; wide regexes; and conditions using filesize, $a at N, @a, uint16(…), entrypoint or for..of loops.

Limitations: the sample is read as UTF-8 text, so binary bytes not expressible as pasted text cannot be represented — test those with the real engine. YARA's regex engine is not JavaScript's; complex patterns (back-references, some assertions) may differ. The tester is a quick sanity check, not a substitute for compiling with yara.

YARA syntax reference

Modifiers — text strings: nocase, wide, ascii, fullword, xor, base64, base64wide, private. Regex strings: nocase, wide, ascii, fullword, private (not xor/base64). Hex strings: private only. Incompatible pairs (e.g. xor + nocase, base64 + fullword) are flagged, not emitted.
Hex strings support nibble wildcards (??), jumps ([2-4], [2-], [-]), and alternations (( AA | BB )). A hex string may not start or end with a jump.
Conditions use and/or/not, all of them, any of them, N of ($s*), counts via #s1 > 2, offsets via $s1 at 0, and filesize.
Set a filesize bound for scan performance: filesize < 5MB and any of them.
Official docs: Writing YARA rules, string modifiers, conditions.