Sources, licences and attribution
The library mirrors the YARA Forge core package (release 20260927, 2026-09-27). YARA Forge collects rules from public repositories, filters them by quality and adds normalised metadata. Each rule keeps the licence of its repository — or the one stated in its own meta.
What we publish
- Full text when the licence allows redistribution (DRL 1.1, MIT, BSD, Apache-2.0, GPL-3.0, CC BY / BY-SA, Unlicense), with author, upstream link and licence on every page and download.
- Metadata only for repositories without a licence (all rights reserved by default) and for non-commercial or unknown terms: name, description, author, dates, references and sample hashes, with a link to the original rule.
- The Detection Rule License also asks that match messages keep the rule author: our scanner shows the author of every matching rule.
5,110 rules: 4,745 with full text, 365 metadata only.
| Source | Licence | Published | Rules |
|---|---|---|---|
| Malpedia signator rules | Creative Commons Attribution-ShareAlike 4.0 | Full text | 1582 |
| Signature Base (Florian Roth / Nextron) | Detection Rule License 1.1 | Full text | 1078 |
| SEKOIA.IO Community | Detection Rule License 1.1 | Full text | 706 |
| ditekSHen detection | BSD 2-Clause License | Full text | 609 |
| Mandiant red team tool countermeasures | BSD 2-Clause License | Full text | 147 |
| Arkbird SOLG (DailyIOC) | No licence (all rights reserved) | Metadata | 126 |
| CAPE Sandbox (CAPEv2) | GNU General Public License v3.0 | Full text | 121 |
| RussianPanda | No licence (all rights reserved) | Metadata | 102 |
| Volexity threat-intel | BSD 2-Clause License | Full text | 91 |
| Google Cloud Threat Intelligence (GCTI) | Apache License 2.0 | Full text | 89 |
| Trellix Advanced Research Center | Apache License 2.0 | Full text | 58 |
| ESET malware-ioc | BSD 2-Clause License | Full text | 57 |
| LOLDrivers | Apache License 2.0 | Full text | 48 |
| HarfangLab IOCs | No licence (all rights reserved) | Metadata | 38 |
| Embee Research | Detection Rule License 1.1 | Full text | 35 |
| SecuInfra Falcon Team | No licence (all rights reserved) | Metadata | 33 |
| Avast / Gen Digital IOC | Detection Rule License 1.1 | Full text | 30 |
| WithSecure Labs IOCs | BSD 2-Clause License | Full text | 24 |
| BlackBerry Research & Intelligence (via Open-Source-YARA-rules) | No licence (all rights reserved) | Mixed (20/21) | 21 |
| Samir Bousseaden (YaraHunts) | No licence (all rights reserved) | Metadata | 18 |
| elceef yara-rulz | MIT License | Full text | 16 |
| Frank Boldewin (R3c0nst) | No licence (all rights reserved) | Metadata | 16 |
| Costin Raiu yararules | GNU General Public License v3.0 | Full text | 10 |
| Cod3nym detection-rules | Detection Rule License 1.1 | Full text | 8 |
| Cluster25 (via Open-Source-YARA-rules) | No licence (all rights reserved) | Metadata | 8 |
| NCSC (via Open-Source-YARA-rules) | No licence (all rights reserved) | Metadata | 8 |
| Telekom Security malware analysis | No licence (all rights reserved) | Metadata | 7 |
| Cado Security (via Open-Source-YARA-rules) | No licence (all rights reserved) | Full text | 7 |
| dr4k0nia yara-rules | Detection Rule License 1.1 | Full text | 4 |
| Check Point (via Open-Source-YARA-rules) | No licence (all rights reserved) | Metadata | 4 |
| Synacktiv rules | Detection Rule License 1.1 | Full text | 3 |
| deadbits yara-rules | The Unlicense | Full text | 2 |
| delivr.to detections | No licence (all rights reserved) | Metadata | 2 |
| artifact-drop | No licence (all rights reserved) | Metadata | 1 |
| Microsoft (via Open-Source-YARA-rules) | No licence (all rights reserved) | Metadata | 1 |
Licence decisions are our reading of each repository's terms, reviewed on 2026-09-29. Rule authors can ask for a change at any time.