OBSCURA OSPRO
Settings

Write and test YARA rules against a file, in the browser YARA

YARA is how analysts write detections. This runs the match in the browser, so a rule can be tried against a real, sensitive sample without the sample ever leaving the machine.

The rules

The sample

Drop a file here, or open one No sample yet. Open a file or paste text below.
How it works

What it runs, and what it does not

This matches strings-and-condition rules exactly: text with nocase/wide/ascii/fullword, hex with ?? and [n] jumps, regex with i/s flags, and conditions with and/or/not, any/all/N of them, #a counts and filesize. It does not implement YARA's pe./elf./math. modules or offset operators; for those, and to sign off a finished rule, use the yara binary. Everything here stays in the browser.

Doing this often? The Sovereign Console runs detection across every file in a case, with Sigma rules and hash sets, and exports a report. On its own, US$4 a month; with everything else, US$9 a month or US$79 a year. 7 days free.