YARA Malware Detection Rules
For a malware detection rule toolkit, the first results are cystack/stealer-fingerprints (This repository delivers exactly what you need: a public catalog of YARA rules for 30+ stealer malware families RedLine, Vidar, Lumma, etc., built for incident response and detection engineering, with community-contributed fingerprints and field signatures), neo23x0/signature-base (neo23x0/signature-base is a repository of YARA signatures and IOCs, giving you pre-written rules for malware detection and integration with threat intelligence feeds, which directly matches the search for a YARA rule repository) and elastic/protections-artifacts. eset/malware-ioc and yara-rules/rules round out the shortlist. Compare the match explanations and check the project documentation against your requirements.
Collection of open-source YARA rule sets designed to identify and analyze specific malware family signatures.
YARA Malware Detection Rules
Find the best repos with AI.We'll search the best matching repositories with AI.
- cystack/stealer-fingerprints
cystack/stealer-fingerprints
Public catalog of stealer log fingerprints. Banner strings, field signatures, sanitized samples, and YARA rules for 30+ malware families including RedLine, Vidar, Lumma, StealC, and Rhadamanthys. For incident response, detection engineering, and threat intelligence research.
This repository delivers exactly what you need: a public catalog of YARA rules for 30+ stealer malware families (RedLine, Vidar, Lumma, etc.), built for incident response and detection engineering, with community-contributed fingerprints and field signatures.
YARAYara Rule Collections - neo23x0/signature-base
Neo23x0/signature-base
2,975View on GitHubYARA signature and IOC database for my scanners and tools
neo23x0/signature-base is a repository of YARA signatures and IOCs, giving you pre-written rules for malware detection and integration with threat intelligence feeds, which directly matches the search for a YARA rule repository.
YARAYara Rule CollectionsThreat Intelligence Feeds - elastic/protections-artifacts
elastic/protections-artifacts
1,441View on GitHubElastic Security detection content for Endpoint
Elastic's protections-artifacts repository provides a comprehensive, pre-written set of YARA rules for endpoint malware detection, backed by Elastic's security research and community contributions, which exactly matches your need for a YARA rule collection with community involvement.
YARAYara Rule Collections - eset/malware-ioc
eset/malware-ioc
1,955View on GitHubIndicators of Compromises (IOC) of our various investigations
ESET's malware-ioc repository provides YARA rules and indicators of compromise from their investigations, making it a relevant source of pre-written malware family rules for YARA-based detection.
YARAYara Rule CollectionsThreat Intelligence Feeds - yara-rules/rules
Yara-Rules/rules
4,712View on GitHubThis project is a community-curated repository of YARA rules used to detect malware, webshells, and other malicious patterns in files. It serves as a dataset of signatures for identifying known malware families, software packers, and threat intelligence indicators. The collection provides specialized detection capabilities for identifying exploit kits and anti-analysis evasion techniques, such as anti-debugging and anti-virtualization methods. It also includes signatures for cryptographic algorithm detection and the identification of unauthorized remote administration tools on servers. The r
This repository is a community-curated collection of YARA rules for detecting malware, webshells, and other malicious patterns, which directly matches the request for pre-written rules with community contributions and threat intelligence integration.
YARAMalware Family IdentificationYara Rule CollectionsThreat Intelligence Feeds - anyrun/yara
anyrun/YARA
Maintained by the ANY.RUN team, this repository provides YARA rules to help detect and classify various malware families and other malicious artifacts.
anyrun/yara is a community-maintained collection of YARA rules targeting malware families from the ANY.RUN team, directly matching the request for pre-written detection rules, though it does not explicitly include rule testing tools or malware feed integration.
YARAYara Rule Collections - bartblaze/yara-rules
bartblaze/Yara-rules
Collection of private Yara rules.
This repository is a private collection of YARA rules for malware detection, fitting the request for a rule repository, but as a single-author collection it may be less comprehensive than larger community-driven rule sets and lacks built-in testing or feed integration.
YARAYara Rule Collections - chronicle/gcti
chronicle/GCTI
This repository contains GCTI's open source detection signatures.
GCTI’s repository provides ready-made YARA detection signatures for malware families from Google Cloud Threat Intelligence, which directly fits the need for a community-oriented YARA rule repository, though it lacks built-in testing or feed integration.
YARAYara Rule Collections - deadbits/yara-rules
deadbits/yara-rules
Collection of YARA signatures from individual research
deadbits/yara-rules is a repository of YARA signatures from individual research, providing pre-written malware detection rules that directly match your need for YARA rulesets, though it lacks built-in testing/validation or feed integration features.
YARAYara Rule Collections - delivr-to/detections
delivr-to/detections
A home for detection content developed by the delivr.to team
A YARA rule collection from the delivr.to team, matching the request for a repository of detection rules, though it lacks explicit rule testing/validation or malware feed integration features.
YARAYara Rule Collections - ditekshen/detection
ditekshen/detection
Detection in the form of Yara, Snort and ClamAV signatures.
This repository contains YARA signatures alongside Snort and ClamAV rules, making it a valid YARA rule repository for malware detection, though it does not explicitly provide rule testing or feed integration.
YARAYara Rule Collections - fboldewin/yara-rules
fboldewin/YARA-rules
Some YARA rules i will add from time to time
This is a personal collection of YARA rules from a single author, which fits as a repository of malware detection rules but lacks community contributions, testing tools, or integration with threat feeds.
YARAYara Rule Collections - fideliscyber/indicators
fideliscyber/indicators
This repository is tagged as a YARA rule collection, making it directly relevant for finding pre-written malware detection rules, though the empty description means its exact scope and features are unconfirmed.
Yara Rule Collections - filescanio/fsyara
filescanio/fsYara
A collection of curated YARA rules used as part of the Filescan.io service
A curated collection of YARA rules from the Filescan.io service, giving you pre-written detection rules for malware families, though it is a service-specific set rather than a broad community repository.
YARAYara Rule Collections - advanced-threat-research/yara-rules
advanced-threat-research/Yara-Rules
Repository of YARA rules made by Trellix ATR Team
This is a dedicated collection of YARA rules from the Trellix ATR team, directly targeting malware detection with pre-written rules, fitting the search for a YARA rule repository for detecting specific malware families.
YARAYara Rule Collections - citizenlab/malware-signatures
citizenlab/malware-signatures
Yara rules for malware families seen as part of targeted threats project
This repository contains YARA rules written for malware families tracked by the Citizen Lab's targeted threats project, giving you pre-written detection signatures that directly match the request for malware-specific rulesets.
VimLYara Rule Collections - codewatchorg/burp-yara-rules
codewatchorg/Burp-Yara-Rules
Yara rules to be used with the Burp Yara-Scanner extension
This repository is a collection of YARA rules designed for the Burp Yara-Scanner extension, so it fits the YARA rule repository category, but the rules are focused on passive web scanning rather than the broad malware-family detection you are seeking.
YARAYara Rule Collections - kevthehermit/yararules
kevthehermit/YaraRules
My Yara Rules Collection
This repository is a collection of YARA rules for malware detection, matching your need for pre-written rules even though it does not include built-in testing tools or feed integration.
Yara Rule Collections - neo23x0/yargen
Neo23x0/yarGen
1,796View on GitHubyarGen is a generator for YARA rules
yarGen is a generator for creating YARA rules from strings in malicious files, making it a helpful tool for rule creation but not a repository of pre-written malware family rules.
PythonYara Rules
Compare the top 10 at a glance
| Repository | Stars | Language | License | Last push |
|---|---|---|---|---|
| cystack/stealer-fingerprints | 2 | YARA | Apache-2.0 | |
| neo23x0/signature-base | 3K | YARA | NOASSERTION | |