YARA 恶意软件检测规则

This repository delivers exactly what you need: a public catalog of YARA rules for 30+ stealer malware families (RedLine, Vidar, Lumma, etc.), built for incident response and detection engineering, with community-contributed fingerprints and field signatures.

neo23x0/signature-base is a repository of YARA signatures and IOCs, giving you pre-written rules for malware detection and integration with threat intelligence feeds, which directly matches the search for a YARA rule repository.

Elastic's protections-artifacts repository provides a comprehensive, pre-written set of YARA rules for endpoint malware detection, backed by Elastic's security research and community contributions, which exactly matches your need for a YARA rule collection with community involvement.

ESET's malware-ioc repository provides YARA rules and indicators of compromise from their investigations, making it a relevant source of pre-written malware family rules for YARA-based detection.

This repository is a community-curated collection of YARA rules for detecting malware, webshells, and other malicious patterns, which directly matches the request for pre-written rules with community contributions and threat intelligence integration.

anyrun/yara is a community-maintained collection of YARA rules targeting malware families from the ANY.RUN team, directly matching the request for pre-written detection rules, though it does not explicitly include rule testing tools or malware feed integration.

This repository is a private collection of YARA rules for malware detection, fitting the request for a rule repository, but as a single-author collection it may be less comprehensive than larger community-driven rule sets and lacks built-in testing or feed integration.

GCTI’s repository provides ready-made YARA detection signatures for malware families from Google Cloud Threat Intelligence, which directly fits the need for a community-oriented YARA rule repository, though it lacks built-in testing or feed integration.

deadbits/yara-rules is a repository of YARA signatures from individual research, providing pre-written malware detection rules that directly match your need for YARA rulesets, though it lacks built-in testing/validation or feed integration features.

A YARA rule collection from the delivr.to team, matching the request for a repository of detection rules, though it lacks explicit rule testing/validation or malware feed integration features.

This repository contains YARA signatures alongside Snort and ClamAV rules, making it a valid YARA rule repository for malware detection, though it does not explicitly provide rule testing or feed integration.

This is a personal collection of YARA rules from a single author, which fits as a repository of malware detection rules but lacks community contributions, testing tools, or integration with threat feeds.

This repository is tagged as a YARA rule collection, making it directly relevant for finding pre-written malware detection rules, though the empty description means its exact scope and features are unconfirmed.

A curated collection of YARA rules from the Filescan.io service, giving you pre-written detection rules for malware families, though it is a service-specific set rather than a broad community repository.

This is a dedicated collection of YARA rules from the Trellix ATR team, directly targeting malware detection with pre-written rules, fitting the search for a YARA rule repository for detecting specific malware families.

This repository contains YARA rules written for malware families tracked by the Citizen Lab's targeted threats project, giving you pre-written detection signatures that directly match the request for malware-specific rulesets.

This repository is a collection of YARA rules designed for the Burp Yara-Scanner extension, so it fits the YARA rule repository category, but the rules are focused on passive web scanning rather than the broad malware-family detection you are seeking.

This repository is a collection of YARA rules for malware detection, matching your need for pre-written rules even though it does not include built-in testing tools or feed integration.

yarGen is a generator for creating YARA rules from strings in malicious files, making it a helpful tool for rule creation but not a repository of pre-written malware family rules.