EN FR
Features How it works Pricing Contact Login
🕒 Last updated: October 14, 2026

YARA rules: filter your email with your own rules

Learn what the "Yara rules" module of the Clean Mailbox interface is for, how rule statuses and actions work, and get started from a concrete example.

⚠️

Beta feature: the Yara rules module is currently in beta. Its behavior and interface may change, and some rough edges are possible. Feel free to send us your feedback.

What it is for

Clean Mailbox's filters (antivirus, anti-spam) protect against known threats. The Yara rules module complements them with your own rules, to handle cases that are specific to your organization: a phishing campaign impersonating your management, fraudulent invoices that keep coming back with the same wording, a keyword you never want to see reach certain mailboxes, and so on.

YARA is a pattern description language: a rule describes text strings (or regular expressions) to look for in a message, and a condition that says when the rule "matches". Clean Mailbox analyzes every message received by your domain against your rules, then applies the action you chose.

Where to find the module

In the Clean Mailbox interface, open your domain, then the Yara rules menu. The module is reserved to domain administrators and must be enabled on the domain: if the menu entry isn't visible, contact us to have it enabled.

From this page you can create, edit, reorder and delete rules, and import or export a .yar file. Each entry holds a single YARA rule, with:

When you save, the rule is validated: if its syntax is invalid, the YARA error is displayed and nothing is saved.

Rule statuses

The status determines whether the rule is evaluated, and whether its action is really applied.

StatusIs the rule evaluated?Impact on email
Inactive No None. The rule is kept but ignored; it doesn't count toward your limits.
Audit (log only) Yes None on the message, which is delivered normally. Every match is recorded along with what the rule would have done ("would have tagged" or "would have blocked").
Active Yes The rule's action is applied to the message: a tag is added to the subject, or the message is blocked.
💡

Recommended approach: always create a new rule in audit. Let it run for a few days, review its matches, check that it only catches what you're aiming at, then switch it to active. A rule that is too broad can otherwise block legitimate email.

An inactive rule is handy to set a rule aside (for example, a campaign that is over) without losing it, or to prepare an imported rule before testing it. Inactive rules don't count toward the rule and pattern limits.

Actions: tag or block

The action only applies if the rule is active (in audit, it is only logged).

Tag

The message is delivered, but the tag text you defined is added at the beginning of its subject, for example [SUSPICIOUS INVOICE] Your invoice no. 4821. The recipient keeps the final say while being alerted; you can also rely on this tag to build a sorting rule in your mail platform (move to a folder, alert a team, etc.).

Block

The message is not delivered: it is removed before reaching the recipient's mailbox, with no notification to the sender. A copy is kept in your quarantine, where you can review it and restore it in case of a false positive.

Status"Tag" action"Block" action
Inactive Nothing (rule ignored) Nothing (rule ignored)
Audit Message delivered as is; "would have tagged" in the follow-up Message delivered as is; "would have blocked" in the follow-up
Active Message delivered, tag added to the subject Message removed, copy kept in quarantine

Evaluation order and "If the rule matches"

Rules are evaluated in the order shown in the table (use the arrows to move them up or down). A rule in audit never affects what follows: it is logged and the evaluation continues.

For an active rule with the "Tag" action, the If the rule matches field defines what happens next:

A blocking rule always stops: this choice therefore only exists for tags. Put your safest blocking rules first.

Example rule

Goal: spot fake bank-details change requests, a classic of CEO fraud, and flag them to the recipient without blocking anything at first.

1. The YARA code

rule Bank_details_change_fraud
{
    meta:
        description = "Request to change bank details"

    strings:
        $bank1 = "change of bank details" nocase
        $bank2 = "new bank account" nocase
        $bank3 = "updated IBAN" nocase
        $urgent1 = "urgent" nocase
        $urgent2 = "today" nocase
        $urgent3 = "confidential" nocase

    condition:
        any of ($bank*) and any of ($urgent*)
}

This rule matches a message that contains at least one bank-details expression and at least one urgency term. Requiring both limits false positives: a plain "IBAN" in a legitimate invoice isn't enough.

2. The settings in the interface

FieldValue
TitleBank details change fraud
StatusAudit to begin with
ActionTag
Tag[CHECK BANK DETAILS]
If the rule matchesContinue

3. Going live

  1. Save the rule in audit and let it run for a week or two.
  2. Review its matches (see below) and check that they are real fraud attempts, not legitimate messages.
  3. If needed, refine the condition (remove an overly common term, require more patterns).
  4. Switch the rule to active: suspicious messages now arrive with the [CHECK BANK DETAILS] tag in their subject.
  5. If you're confident the rule is reliable, you can switch the action to Block.
⚠️

A rule only matches if all the elements of its condition are met. Always test your rules in audit before activating them, and favor precise patterns over very common words.

Follow the matches

The Yara rules page shows, for each rule, the number of matches over the last 30 days (audit included), including how many times the action was really applied, as well as the 20 latest matches.

The realtime view also lets you find each message concerned. Messages blocked by your rules are flagged as such there; they are also in your quarantine.

Limits and best practices

Frequently asked questions

Do I need to know YARA to use the module?

Simple rules, like the one in the example, can be written without in-depth knowledge: a list of strings and a condition. For more advanced cases, the official YARA documentation describes the language in detail.

What happens if my rule is too slow or fails?

The message is delivered normally: analysis is time-limited, and a failing rule is ignored without preventing the others from applying.

Is a blocked email lost?

No. It is kept in your quarantine, where you can review it and restore it in case of a false positive.

What's the difference between "audit" and "inactive"?

A rule in audit is evaluated and its matches are recorded, with no effect on email. An inactive rule isn't evaluated at all.

Need help enabling the module?

Our support team can help you enable the module on your domain and validate its configuration. Writing and maintaining the rules themselves remains your responsibility.

Contact Clean Mailbox →

Let's protect your mailbox.

Questions about the trial, setup, pricing, or a partnership? We're here — and we answer fast.

✓ 30-day free trial, no card required
✓ Works with any mail server
✓ Setup in under 5 minutess
✓ Infrastructure based in France 🇫🇷