Execute a YARA search

Validin provides an environment for developing, testing, and executing YARA rules across global web infrastructure and linking those rules to threat-hunting Projects.

Analysts can scan parsed HTTP response bodies for phishing kits, injected JavaScript, credential harvesters, and other malicious web content by writing a rule, validating it, and executing it at scale.

For details on YARA syntax and conventions, read the official specification.

📘

YARA compatibility

Validin offers full support for YARA-X. Functionality is currently in beta and is limited to HTTP responses. Rule behaviour and the UI may change as improvements are released.

Access the Validin YARA Playground

To begin writing a rule:

1. Open a Project.
2. Select the YARA Rules tab.
3. Select Add Rule to open the YARA Playground.

The interface provides a Rule Editor, a Test Document panel, and supporting validation tools.

Write a YARA rule

To define the conditions you want to search for, enter a rule into the editor.

rule Suspicious_JS_Injection {
  meta:
    description = "Detects suspicious JavaScript injection markers"
  strings:
    $s1 = "<script>"
    $s2 = "eval("
  condition:
    any of them
}

👍

Getting started

Begin with simple conditions to ensure you can verify match precision during testing.

Test the rule

Before running a global search, validate the rule locally to allow rapid refinement prior to executing the full search:

1. Edit or replace the Test Document panel content to simulate HTML or script content.
2. Select Run test.
3. Review matches under Test Matches tab below.
4. Check the Problems tab to identify syntax errors or rule issues.

Execute the search

To run the rule against recently observed HTTP responses:

1. Select Save.
2. Return to the YARA Rules tab in the Project.
3. Open the rule.
4. Select View or the rule’s run action to execute it.

Validin evaluates the rule against live telemetry and displays results in the All Matches tab.

Interpreting match results

To understand each match, review the fields provided in the results table:

Selecting a result opens the full HTTP event, including HTML content, certificates, response banners, JARM fingerprints, and additional metadata.