YARA Rule Builder

About this tool

YARA is the standard way to describe malware families and suspicious files as patterns. A rule has a name, optional metadata, a list of strings (text, hex bytes or regular expressions) and a condition that says how many of them must match and what kind of file it is. The syntax is strict: a rule name that is a keyword, a hex string that starts with a jump, a modifier that cannot be combined with another, or a string that the condition does not use all make YARA refuse the rule. This builder writes the rule from a form and refuses what YARA refuses. Add text strings (quotes, backslashes, line breaks and non-ASCII characters are escaped for you) with the options ignore case, wide (UTF-16), ascii, whole word, xor and private. Add hex strings with bytes (4D 5A), wildcards (?? and 4?), jumps ([2-6]), alternatives (( 4D 5A | 50 4B )) and not-bytes (~00); bytes written together (4d5a??00) are fine. Add regular expressions: YARA has its own regular-expression engine, so the builder accepts a defined subset that means the same in YARA and everywhere else (literals, dot, anchors, groups, alternation, character classes and ranges, the repeats * + ? {n} {n,} {n,m} with lazy versions, and the escapes \d \s \w \b \xHH \n \t) and refuses what YARA rejects or reads differently, such as look-around, (?:...) groups, back-references, \u or \p escapes, POSIX classes like [[:alpha:]] and non-ASCII characters (write those as \xHH bytes). A slash in the pattern is escaped for you. Then choose the condition: any, all, or at least N of the strings, and optionally restrict it to a file type (a Windows program, Linux program, PDF, ZIP or Office file, or macOS program, checked by their header bytes) and a size limit. Metadata covers description, author, reference, date and the hash of the sample. The tool uses YARA's own name for each string ($s1 for text, $h1 for hex, $r1 for regular expressions). We checked it against the real YARA 4.5.4 and its results, not against a description of it. All 160 combinations of string type and modifier were compared with what YARA accepts and refuses; a set of about 60 hex string forms was compared the same way; rule names were checked against every YARA keyword we know of plus ordinary names; 63 regular expressions were run against 55 test strings and gave the same matches in YARA and in JavaScript (3,465 results); and rules for each kind of string, modifier, file-type header, size and condition were compiled and run against crafted data to confirm the expected data matches. These are broad checks on the common cases, not a proof for every possible input. In a few places the builder is deliberately stricter than YARA 4.5 (for example, a hex string made only of wildcards or two jumps in a row, which older YARA versions reject). It writes text only and scans nothing, and what you type stays in your browser. Test every rule on files you are allowed to scan before relying on it, because short or common strings cause false positives.

How to use it

1. Name the rule and add any tags or details.
2. Add the strings to look for: text, hex bytes or a regular expression, with their options.
3. Choose the condition, and optionally a file type and size limit.
4. Copy the rule or download it as a .yar file.

Example

The file-type test checks the PE header, so it only applies to Windows programs.

name: demo_loader · text: cmd.exe /c (ignore case, wide) · hex: 4D 5A ?? 00 · type: Windows program · size: under 2 MB · any of them

rule demo_loader
{
    strings:
        $s1 = "cmd.exe /c" nocase wide
        $h1 = { 4D 5A ?? 00 }
    condition:
        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and filesize < 2MB and any of them
}

Common problems

It says a string is not used by the condition

YARA refuses a rule with a string that the condition never mentions. Choose any, all or a count so every string is used, or delete the extra string.

My regular expression is refused

YARA's regular expressions are a small subset of PCRE. Look-ahead, look-behind, (?:...) groups, back-references, \u and \p escapes, POSIX classes, empty groups and non-ASCII characters are refused. Use the ignore-case and dot options for flags, and \xHH for non-ASCII bytes.

The rule matches too much

Short strings and common words match innocent files. Use longer, more specific strings, add a file type and size limit, or require several strings.