DOCSEARCHbyAlgolia
Submit Docs

neo23x0/signature-base

repository·master·Indexed 25 days ago

https://github.com/neo23x0/signature-base

A curated repository of YARA rules and Indicators of Compromise (IOCs) designed for use with security scanners such as LOKI and THOR Lite. The repository includes CSV-formatted IOCs, YARA signatures, and a Threat Intel API Receiver supporting MISP and OTX.

Tokens
567
Snippets
0
Records
7
Agent score
34%

What's inside signature-base

  1. Overview of Signature-Base

    master
    Signature-Base is a database of YARA signatures and Indicators of Compromise (IOCs) designed specifically for use with the LOKI and THOR Lite scanners. It focuses on providing high-quality rules with minimal false positives, a clear directory structure, and consistent rule formatting.

  2. Report false positives or bugs in rules

    master

    To contribute to the quality of the signatures:

    • Report False Positives: Open an issue in the repository's issues section.
    • Fix Bugs: Navigate to the specific rule file, click the 'edit' icon, apply your fix, and submit a pull request.

  4. Initialize IOC files by filename strings

    master

    Files located in the iocs/ directory are initialized based on specific strings contained within their filenames. Use the following naming conventions to define the type of Indicator of Compromise (IOC) list:

    • To create a hash IOC list, include the string hash in the filename.
    • To create a filename IOC list, include the string filename in the filename.
    • To create a C2 server IOC list, include the string c2 in the filename.

  5. Handle undefined identifier errors in YARA rules

    master

    If you use these YARA rules in a tool other than LOKI or THOR Lite, you may encounter undefined identifier errors. This is because some rules rely on external variables.

    To resolve this, identify the rules using external variables (listed in ./yara/external-variable-rules.txt) and remove them from your local implementation.

  6. Check the license for signatures and IOCs

    master

    As of 13.08.2021, the repository uses the Detection Rule License (DRL) 1.1.

    • Most signatures and IOC files are licensed under DRL 1.1.
    • Exception: Some YARA rules may indicate a different license within their license metadata. Always check the metadata of individual rules if you are using them in a commercial or restricted environment.

  7. Understand the Signature-Base directory structure

    master

    The repository is organized into the following directories:

    • iocs: Contains simple IOC files in CSV format.
    • yara: Contains the YARA rules.
    • threatintel: Contains the Threat Intel API Receiver (supporting MISP, OTX).
    • misc: Contains other input files that are neither IOCs nor signatures.