Neo23x0/signature-base

YARA matches patterns against files and process memory, not against events. A rule answers "is this artifact malicious", never "did this behavior happen". There is no time window, no event stream and no correlation — you point a scanner at a file, a directory or a running process and it reports which rules matched.

signature-base is the open ruleset behind Nextron's THOR and LOKI scanners, maintained largely by Florian Roth. Its center of gravity is APT tooling, webshells, hacktools and forensic artifacts — the things an incident responder sweeps a compromised host for.

Three sections:

rule Kriskynote_Mar17_1 {
   meta:
      description = "Detects Kriskynote Malware"
      author = "Florian Roth (Nextron Systems)"
      date = "2017-03-03"
      hash1 = "a19c4b615aa54207604b181873e614d84126b639fee2cce3ca9d5bd863f6f577"
   strings:
      $s1 = "gzwrite64" fullword ascii
      $opa1 = { e8 6b fd ff ff 83 f8 ff 74 65 83 7b 28 00 74 42 }
   condition:
      uint16(0) == 0x5a4d and filesize < 400KB and $s1 and ($opa1 or all of ($opb*))
}

Rules here mix printable strings with hex opcode patterns, and the condition almost always anchors on file structure first — uint16(0) == 0x5a4d is "this is a PE", and a filesize bound keeps the scan cheap. That ordering matters: it is what keeps a rule from scanning every file on disk.

meta carries the provenance a responder needs — reference URLs and the sample hashes the rule was built from.

The rule body is shown verbatim; there is nothing to normalize into a query.

Severity and ATT&CK read as absent, not as zero. YARA has no severity field and no technique field, so this ruleset maps neither. That is a property of the format, not a judgment on the content — these are among the most widely deployed detection rules in existence.

meta hashes are extracted as IOCs, and reference URLs as references, so a rule's page still gives you the pivot points even though the format carries no structured scoring.

• Rules are licensed under the Detection Rule License 1.1, not the repository's own license. Check before redistributing.
• Many rules encode a filesize ceiling as part of the condition. A sample larger than that bound will not match even if every string is present — this is a common source of "why didn't my rule fire".
• Matching a rule means matching an artifact, which is not the same as confirming execution. A YARA hit on a file at rest is a lead, not an incident.