Detection · YARA
Custom YARA rules
Ship your own detection rules into our scanner. Each rule is validated against the production yara 4.5 binary on save and ships into the URL-scan pipeline on the next scan after activation. Rules live alongside our 32 curated public-source rules; matches surface in the per-finding rule citation chip.
Quick reference:
Rules apply to the captured DOM HTML of every URL we scan for your account.
Body must contain a
rule <name> keyword and stay under 32 KB.
Allowed imports: math, hash, string.
Use $x_ prefix for highly specific strings, $s_ for grouped strings, $fp_ for false-positive filters.
Test syntax with the Validate button (no save).
See the YARA documentation for the full rule language.