# YARA Tester

Build a YARA rule string by string, and scan a pasted sample live. The matching is real and byte-level.

Build a YARA rule and scan text, hex or a file with it, byte by byte, in the page. Every offset shown is where the bytes were actually found.

## How to read it

Text strings take ascii, wide and nocase. Windows binaries keep many strings in UTF-16, so add wide when you hunt them.

Hex strings take ?? for any byte. Use it for version digits and other bytes that change between builds.

The condition says how many strings must hit: any of them, all of them, 2 of them, or a list.

## Related

- [Sigma Tester](https://www.cyberkit.win/tools/sigma-tester/)
- [Entropy & Strings](https://www.cyberkit.win/tools/entropy-strings/)
- [YARA Rule Drill](https://www.cyberkit.win/drills/yara/)

Canonical: https://www.cyberkit.win/tools/yara-tester/

This runs in the browser. Nothing you enter is uploaded.