Runs entirely in your browser: files never leave your device.
YARA rules you can search, read and test in your browser
5,110 rules from 35 public sources, each with its author and licence — plus a YARA-X scanner, editor and linter that run locally. Nothing is uploaded.
- rules
- 5,110
- with full text
- 4,745
- sources
- 35
- malware families
- 363
Tools
Runs entirely in your browser: files never leave your device.
Popular malware families
Learn to write YARA rules
From the first rule to fast, well-tested detections.
- 01
What is YARA? Pattern matching for malware hunters
What YARA is, how a YARA rule matches bytes in files and memory, where it is used in detection and incident response, and how YARA-X fits in.
- 02
YARA syntax: anatomy of a rule
The structure of a YARA rule: identifiers, tags, meta, strings and condition sections, imports, comments, private and global rules, and common syntax errors.
- 03
YARA strings: text, hex and regex patterns
How to write YARA strings: text strings and escapes, modifiers like nocase, wide, xor and base64, hex strings with wildcards and jumps, and regular expressions.
- 04
YARA conditions: counts, offsets, loops and sets
Write YARA conditions: boolean logic, string counts and offsets, filesize and magic-byte checks, any/all/N of sets, for loops, YARA-X with and rule references.
- 05
YARA modules: pe, elf, dotnet, math, hash and more
Use YARA modules to query parsed file formats: pe imports and sections, elf, macho, dotnet, lnk, math entropy, hash, console and string, with YARA-X notes.
- 06
YARA performance: atoms, fast strings and conditions
Why some YARA rules are slow and how to fix them: how atoms and the prefilter work, good and bad strings, hex with fixed bytes, regex anchors and cheap guards.
- 07
Testing YARA rules: samples, goodware and CI
How to test YARA rules before deploying them: positive samples, a goodware corpus for false positives, yr check, unit tests and a GitHub Actions CI pipeline.
- 08
YARA-X vs YARA: differences and migration
YARA-X, the Rust rewrite of YARA by VirusTotal: compatibility, stricter parsing, new features, CLI differences, a migration checklist and YARA-X in the browser.
- 09
Writing YARA rules for incident response
Use YARA during incident response: scoping, writing a rule from a sample, choosing unique strings, confidence scores, hunting across hosts and memory, and sharing.
Recently updated rules
Defendnot Payload
GenericCAPE Sandbox (CAPEv2)· kevoreilly· 2026-09-22CLEANGULP: Detects decoded runtime strings associated with command-and-control, tasking, and persistence.
APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2026-09-16Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - kernel_utility_driver64.sys, kernel_utility_driver32.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious.
Vulnerable / malicious driverLOLDrivers· Florian Roth· 2026-08-28Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - windivert.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious.
Vulnerable / malicious driverLOLDrivers· Florian Roth· 2026-04-28Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - windivert.sys
Vulnerable / malicious driverLOLDrivers· Florian Roth· 2025-09-18Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - changsha. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious.
Vulnerable / malicious driverLOLDrivers· Florian Roth· 2026-04-28Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - idmtdi.sys
Vulnerable / malicious driverLOLDrivers· Florian Roth· 2025-09-18Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious.
Vulnerable / malicious driverLOLDrivers· Florian Roth· 2026-04-28
Where the rules come from
Rules are mirrored from the YARA Forge core package (release 20260927). Full text is shown only when the licence allows redistribution; otherwise we show metadata and link to the original.
Questions
- Is it safe to scan files here?
- Yes. The YARA-X engine is compiled to WebAssembly and runs in a Web Worker in your browser. Files are read locally with the File API and are never uploaded; there is no server-side scanning.
- Where do the rules come from?
- From the YARA Forge core package, which aggregates and quality-filters rules from public repositories such as Signature Base, Malpedia, ditekSHen, ESET and Volexity. Every rule page names its author, repository and licence.
- Why can't I see the text of some rules?
- Some repositories publish rules without a licence, which means all rights are reserved. For those we show metadata and link to the original rule instead of copying it.
- Do the rules work with YARA-X?
- We compile every rule with YARA-X 1.20 at build time. The rule page says whether it compiles cleanly, with warnings, or not at all, and the scanner packs contain only rules that compile.