YARA Rule Validator

Parse and lint a YARA rule for syntax, structure and the patterns that will make it slow, and test it against inert sample text - no files are ever scanned on our servers.

Runs locally

Everything happens in your browser. What you paste or drop here is never uploaded, logged or stored.

Drop YARA rule files

Parsed and linted in your browser. Rules are never run against any file.

Or paste rules

Find the error before yarac does, and the slow rule before your scanner does

This validator reads the YARA 4 rule language: imports and includes, private and global rules, tags, meta, text, hex and regular-expression strings with their modifiers, and the full condition syntax. That includes string counts and offsets, of and for loops, ranges, percentages, and module fields and functions. It reports the errors YARA itself would refuse to compile:

undefined strings;
strings defined but never used;
duplicate names;
a module used without its import;
modifiers that cannot be combined (nocase with xor, fullword with base64);
malformed hex strings.

Performance, explained

YARA is fast because it first searches for short fixed "atoms" taken from each string, and only evaluates a rule where those atoms occur. Rules that give it poor atoms make every scan slower: strings under four bytes, hex strings that are mostly wildcards, and regular expressions that begin with .* or contain no literal text. The same goes for loops that walk every byte up to filesize. Each warning here says which of these applies and why it matters. These are heuristics you can weigh, not verdicts.

Nothing is scanned

The page parses rule text and nothing else. It does not run rules against files, has no scanning engine, and never fetches the targets of include statements. Includes are listed so you can paste them too. The examples on this page use harmless placeholder strings.

Frequently asked questions

Why is an unused string an error, not a warning?

Because YARA refuses to compile a rule with an unreferenced string. Reporting it as a warning would let you ship a ruleset that fails to load.

Which modules are recognised?

The standard ones: pe, elf, math, hash, dotnet, magic, cuckoo, time, console, string, lnk, macho, dex and crx. Custom modules are accepted when imported, with a note to confirm your build includes them.

Is my rule uploaded?

No. Detection content shows what you can see and what you cannot, so it is parsed in your browser only.

References

Related tools

What this tool can and cannot tell you. It reports what is present in the input you provide. It cannot see anything you did not give it, and a clean result means nothing was found in that input - not that the wider system is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.