YARA-X Rule Workbench

Write, compile, and test YARA-X rules locally in your browser. Inspect rule matches and byte offsets, control scan timeouts, and save findings as evidence.

Advertisement

Compile and test modern YARA rules locally

The workbench embeds the official YARA-X WebAssembly engine. Compile rules before scanning, review compiler diagnostics and warnings, then scan the active Binary Lab artifact without uploading it.

Inspect match evidence

Matched rules include namespace, tags, metadata, string identifiers, match kinds, exact offsets, and lengths. A bounded timeout and per-pattern match limit keep browser scans controlled.

YARA matches are detection evidence, not a malware verdict. Validate rule intent and false-positive conditions before operational use.

Frequently Asked Questions

Which YARA engine does the workbench use?+

It uses the official YARA-X JavaScript bindings and a pinned local WebAssembly engine. Rule compilation and file scanning occur in the browser.

Can a YARA match prove a file is malware?+

No. Matches depend on rule quality and context. Treat them as detection evidence and review false-positive conditions before taking action.

How are scans bounded?+

Artifacts are limited to 32 MiB, rule source to 512 KiB, timeout choices to at most 30 seconds, and reported matches per pattern to a fixed maximum.

Related tools

This tool is provided for informational and educational purposes only. All processing happens in your browser — no data is sent to or stored on our servers. While we strive for accuracy, we make no warranties about the completeness or reliability of results.