Troubleshooting Invalid YARA Rules

  1. On the Endpoint Sensor server, open a command prompt (cmd.exe) and navigate to the <Trend Micro Endpoint Sensor server installation path>\CmdTool\YARA folder.
  2. Issue the following command:
    $...\CmdTool\YARA>yara –m <YARA_file>

    <YARA_file> corresponds to full file name of the YARA file in question.


For additional command line options, refer to the YARA documentation online:

The following output appears:

$:\...\CmdTool\YARA>yara –m c:\invalid.yara
c:\invalid.yara(6): error: untermindated string
c:\invalid.yara(6): error: syntax error, unexpected $end, 
   expecting _REGEXP_

The error: ... results indicate that the YARA file in question does not adhere to the syntax required to validate and parse YARA files. To solve the issue, follow the instructions available from