Public YARA rule sets, YARA Forge and licences
The public YARA rule ecosystem: YARA Forge packages, major repositories like Signature Base and Malpedia, the licences you will meet and what they allow.
Published 4 min read
Thousands of high-quality YARA rules are published for free by researchers, vendors and CERTs. Knowing where they come from — and under which terms — lets you use them safely and give credit where it's due.
YARA Forge
YARA Forge collects rules from dozens of public repositories, then:
- checks that they compile and runs quality tests on them;
- assigns each rule a quality and a score (0–100);
- normalises metadata (
id,date,modified,source_url,license_url…) and prefixes every rule with its source name to avoid collisions; - publishes weekly releases in three packages: core (high quality, low false-positive risk), extended (more rules, some noisier) and full (everything that compiles).
This site mirrors the core package. Every rule page shows the YARA Forge release it came from, the original author, a link to the upstream rule and the licence.
Major repositories
| Repository | Focus | Licence |
|---|---|---|
| Signature Base (Florian Roth / Nextron) | Broad: APT tooling, hack tools, web shells, exploits | DRL 1.1 |
| Malpedia signator rules | One automatically generated rule per malware family | CC BY-SA 4.0 |
| ditekSHen detection | Commodity malware and indicators | BSD 2-Clause |
| SEKOIA.IO Community | Malware and threat-actor tooling | DRL 1.1 |
| ESET malware-ioc | Families from ESET research | BSD 2-Clause |
| Volexity threat-intel | Tooling from Volexity investigations | BSD 2-Clause |
| Google Cloud Threat Intelligence (GCTI) | Cobalt Strike and other frameworks | Apache 2.0 |
| Mandiant red team tool countermeasures | Mandiant red-team tooling | BSD 2-Clause |
| Trellix ARC | Malware and APT research | Apache 2.0 |
| LOLDrivers | Vulnerable and malicious drivers | Apache 2.0 |
| CAPE Sandbox | Payload and configuration extraction | GPL-3.0 |
The full list, with the decision for each source, is on the sources and licences page.
Tools around the ecosystem
| Tool | Role |
|---|---|
| yarGen | Generates draft rules from samples by removing goodware strings — always review its output |
| yaraQA | Finds impossible conditions, bad modifiers and performance issues |
| YARA-CI | Tests rule repositories on GitHub against a goodware corpus |
| awesome-yara | Curated index of rule sets, tools and articles |
Licences you will meet
- Detection Rule License 1.1. Designed for detection content. You may use, modify and redistribute rules, including commercially, if you keep the author, a link to the rule and a licence notice — and keep the author in match messages.
- MIT, BSD 2/3-Clause, Apache 2.0. Permissive software licences: redistribution allowed with the copyright notice and licence text.
- GPL-3.0. Copyleft: redistribution allowed with the licence; derivative works must stay under GPL.
- CC BY / CC BY-SA 4.0. Attribution required; ShareAlike requires adaptations to use the same licence.
- Non-commercial or source-available licences (for example CC BY-NC or the Elastic License 2.0). Restrict commercial reuse or redistribution; read them before bundling rules into a product.
- No licence. Public on GitHub does not mean free to copy. Without a licence, copyright law reserves all rights to the author.
How this site handles licences
- Full text is shown, downloadable and included in the scanner packs only when the licence permits redistribution. Every page and download carries the author, upstream link and licence.
- Metadata only for sources without a licence or with restrictive terms: name, description, author, dates, references and sample hashes, plus a link to the original.
- A licence stated in a rule's own
licensemeta is honoured when it is clear, even inside an unlicensed mirror repository. - The scanner displays the author of every matching library rule, as DRL 1.1 requests.
Using public rules responsibly
- Check the licence before copying rules into your product or repository.
- Keep attribution: author, source link and licence travel with the rule.
- Test on your own goodware before production (see testing and CI) — public rules are written for someone else's environment.
- Prefer pinned releases (such as a YARA Forge tag) over tracking a branch, so you can review changes.
- Contribute fixes upstream when you find false positives.
Browse the rule library by family or source to find rules for the threats you care about.
FAQ
- What is YARA Forge?
- YARA Forge is an open-source project that collects YARA rules from dozens of public repositories, tests and scores them, and publishes weekly packages named core, extended and full.
- Can I copy any YARA rule I find on GitHub?
- Only if its licence allows it. A repository without a licence is all rights reserved by default, even if it is public. Licences such as DRL 1.1, MIT, BSD or Apache-2.0 allow reuse with attribution.
- Why do some rules on this site show only metadata?
- Because their repository grants no licence to redistribute them. We show the name, description, author and references, and link to the original rule.