yara-forge-config.yml

# Collection -------------------------------------------------------------------
repo_staging_dir: "./repos"
yara_repositories:
   - name: "ReversingLabs"
     url: "https://github.com/reversinglabs/reversinglabs-yara-rules/"
     author: "ReversingLabs"
     quality: 90
     branch: "develop"
   - name: "Elastic"
     url: "https://github.com/elastic/protections-artifacts/"
     author: "Elastic"
     quality: 75
     branch: "main"
   - name: "R3c0nst"
     url: "https://github.com/fboldewin/YARA-rules/"
     author: "Frank Boldewin"
     quality: 90
     branch: "master"
   - name: "CAPE"
     url: "https://github.com/kevoreilly/CAPEv2"
     author: "Kevin O'Reilly"
     quality: 70
     branch: "master"
   - name: "BinaryAlert"
     url: "https://github.com/airbnb/binaryalert/"
     author: "Airbnb"
     quality: 80
     branch: "master"
     path: "rules/public"
   - name: "DeadBits"
     url: "https://github.com/deadbits/yara-rules/"
     author: "Adam Swanda"
     quality: 80
     branch: "master"
     path: "rules"
   - name: "DelivrTo"
     url: "https://github.com/delivr-to/detections"
     author: "Delivr.To"
     quality: 80
     branch: "main"
     path: "yara-rules"
   - name: "ESET"
     url: "https://github.com/eset/malware-ioc"
     author: "ESET TI"
     quality: 80
     branch: "master"
   - name: "FireEye-RT"
     url: "https://github.com/mandiant/red_team_tool_countermeasures/"
     author: "FireEye"
     quality: 75
     branch: "master"
     path: "rules"
   - name: "GCTI"
     url: "https://github.com/chronicle/GCTI"
     author: "gssincla@google.com"
     quality: 85
     branch: "main"
     path: "YARA"
   - name: "Malpedia"
     url: "https://github.com/malpedia/signator-rules/"
     author: "Felix Bilstein - yara-signator at cocacoding dot com"
     quality: 75
     branch: "main"
     path: "rules"
   - name: "Trellix ARC"
     url: "https://github.com/advanced-threat-research/Yara-Rules/"
     author: "Trellix ARC Team"
     quality: 70
     branch: "master"
   - name: "Arkbird SOLG"
     url: "https://github.com/StrangerealIntel/DailyIOC"
     author: "Arkbird_SOLG"
     quality: 75
     branch: "master"
   - name: "Telekom Security"
     url: "https://github.com/telekom-security/malware_analysis/"
     author: "Telekom Security"
     quality: 70
     branch: "main"
   - name: "Volexity"
     url: "https://github.com/volexity/threat-intel"
     author: "threatintel@volexity.com"
     quality: 80
     branch: "main"
   - name: "JPCERTCC"
     url: "https://github.com/JPCERTCC/MalConfScan/"
     author: "JPCERT/CC Incident Response Group"
     quality: 80
     branch: "master"
     path: "yara"
   - name: "SecuInfra"
     url: "https://github.com/SIFalcon/Detection"
     author: "SIFalcon"
     quality: 70
     branch: "main"
     path: "Yara"
   - name: "RussianPanda"
     url: "https://github.com/RussianPanda95/Yara-Rules"
     author: "RussianPanda"
     quality: 85
     branch: "main"

   # Open Source YARA Rules collection by Michael Worth
   - name: "CadoSecurity"
     url: "https://github.com/mikesxrs/Open-Source-YARA-rules"
     author: "CadoSecurity"
     quality: 80
     branch: "master"
     path: "Cado%20Security"
   - name: "Check Point"
     url: "https://github.com/mikesxrs/Open-Source-YARA-rules"
     author: "CheckPoint Research"
     quality: 85
     branch: "master"
     path: "Checkpoint"
   - name: "BlackBerry"
     url: "https://github.com/mikesxrs/Open-Source-YARA-rules"
     author: "BlackBerry Threat Research Team"
     quality: 85
     branch: "master"
     path: "BlackBerry"
   - name: "Cluster25"
     url: "https://github.com/mikesxrs/Open-Source-YARA-rules"
     author: "Cluster25"
     quality: 75
     branch: "master"
     path: "Cluster%2025"
   - name: "Dragon Threat Labs"
     url: "https://github.com/mikesxrs/Open-Source-YARA-rules"
     author: "@dragonthreatlab"
     quality: 80
     branch: "master"
     path: "Dragonthreatlabs"
   - name: "Microsoft"
     url: "https://github.com/mikesxrs/Open-Source-YARA-rules"
     author: "Microsoft"
     quality: 80
     branch: "master"
     path: "Microsoft"
   - name: "NCSC"
     url: "https://github.com/mikesxrs/Open-Source-YARA-rules"
     author: "NCSC"
     quality: 80
     branch: "master"
     path: "NCSC"

   # Repos added 23.12.2023
   - name: "Dr4k0nia"
     url: "https://github.com/dr4k0nia/yara-rules"
     author: "Dr4k0nia"
     quality: 85
     branch: "main"
   - name: "EmbeeResearch"
     url: "https://github.com/embee-research/Yara-detection-rules/"
     author: "Matthew Brennan"
     quality: 75
     branch: "main" 
   - name: "AvastTI"
     url: "https://github.com/avast/ioc"
     author: "Avast Threat Intel Team"
     quality: 90
     branch: "master"
   - name: "SBousseaden"
     url: "https://github.com/sbousseaden/YaraHunts/"
     author: "SBousseaden"
     quality: 75
     branch: "master"
   - name: "Elceef"
     url: "https://github.com/elceef/yara-rulz"
     author: "marcin@ulikowski.pl"
     quality: 75
     branch: "main"

   # Repos added 24.12.2023
   - name: "GodModeRules"
     url: "https://github.com/Neo23x0/god-mode-rules/"
     author: "Florian Roth"
     quality: 85
     branch: "master"

   # Repos added 05.01.2024
   - name: "Cod3nym"
     url: "https://github.com/cod3nym/detection-rules/"
     author: "Jonathan Peters"
     quality: 80
     branch: "main"

   # Repos added 11.01.2024
   - name: "craiu"
     url: "https://github.com/craiu/yararules"
     author: "Costin G. Raiu, Art of Noh, craiu@noh.ro"
     quality: 85
     branch: "master"

   # Repos added 25.01.2024
   - name: "DitekSHen"
     url: "https://github.com/ditekshen/detection"
     author: "ditekshen"
     quality: 75
     branch: "master"
     path: "yara"

   # Repos added 17.04.2024
   - name: "WithSecureLabs"
     url: "https://github.com/WithSecureLabs/iocs"
     author: "WithSecureLabs"
     quality: 75
     branch: "master"

   # Repos added 21.04.2024
   - name: "HarfangLab"
     url: "https://github.com/HarfangLab/iocs"
     author: "HarfangLab"
     quality: 80
     branch: "main"

   # Repos added 06.08.2024
   - name: "LOLDrivers"
     url: "https://github.com/magicsword-io/LOLDrivers/"
     author: "LOLDrivers"
     quality: 80
     branch: "main"
     recursive: false
     path: 'detections/yara'

   # Repos added 22.12.2024
   - name: "SEKOIA"
     url: "https://github.com/SEKOIA-IO/Community"
     author: "Sekoia.io"
     quality: 80
     branch: "main"
     recursive: false
     path: 'yara_rules'

   # My own YARA rule collection used for our free scanners
   - name: "Signature Base"
     url: "https://github.com/Neo23x0/signature-base"
     author: "Florian Roth"
     quality: 85
     branch: "master"
     path: "yara"

# Rule Processing --------------------------------------------------------------
rule_base_score: 75

# Quality Checks ---------------------------------------------------------------
# Explanations for the different issue levels used in the rule quality analysis
# Level 1 - cosmetic issues with the rule
# Level 2 - minor issues with the rule
# Level 3 - major issues with the rule
# Level 4 - critical issues with the rule

# Levels and quality score reduction
issue_levels:
   1: -2
   2: -25
   3: -70
   4: -1000

# Default quality of rules
# 0 - no quality
# 100 - high quality
#default_quality: 75 # not used anymore

# Fixed order in the meta data values
meta_data_order:
  - description
  - author
  - id
  - date
  - modified
  - old_rule_name
  - reference
  - source_url
  - license_url
  - hash
  - logic_hash
  - score
  - quality
  - tags

# Rule Package Output ----------------------------------------------------------
yara_rule_packages:
  - name: "core"
    description: "Default YARA Rule Package - Core"
    minimum_quality: 70
    force_include_importance_level: 80
    force_exclude_importance_level: 50
    minimum_age: 1
    minimum_score: 65
    max_age: 2500 # ~ 7 years
  - name: "extended"
    description: "Default YARA Rule Package - Extended"
    minimum_quality: 50
    force_include_importance_level: 70
    force_exclude_importance_level: 20
    minimum_age: 1
    minimum_score: 60
    max_age: 5000 # ~ 14 years
  - name: "full"
    description: "Default YARA Rule Package - Full"
    minimum_quality: 20
    force_include_importance_level: 50
    force_exclude_importance_level: 0
    minimum_age: 0
    minimum_score: 40
    max_age: 10000 # ~ 30 years

rule_set_header: |
  /*
   * YARA-Forge YARA Rule Package
   * https://github.com/YARAHQ/yara-forge
   * 
   * Rule Package Information
   * Name: {rule_package_name} 
   * Description: {rule_package_description}
   * YARA-Forge Version: {program_version}
   * YARA-QA Commit: {yaraqa_commit}
   * Minimum Quality: {rule_package_minimum_quality}
   * Force Include Importance Level: {rule_package_force_include_importance_level}
   * Force Exclude Importance Level: {rule_package_force_exclude_importance_level}
   * Minimum Age (in days): {rule_package_minimum_age}
   * Minimum Score: {rule_package_minimum_score}
   * Creation Date: {retrieval_date}
   * Number of Rules: {total_rules}
   * Skipped: {total_rules_skipped_age} (age), {total_rules_skipped_quality} (quality), {total_rules_skipped_score} (score), {total_rules_skipped_importance} (importance)
   */

repo_header: |
  /*
   * YARA Rule Set
   * Repository Name: {repo_name}
   * Repository: {repo_url}
   * Retrieval Date: {retrieval_date}
   * Git Commit: {repo_commit}
   * Number of Rules: {total_rules}
   * Skipped: {total_rules_skipped_age} (age), {total_rules_skipped_quality} (quality), {total_rules_skipped_score} (score), {total_rules_skipped_importance} (importance)
   *
   * 
   * LICENSE
   * 
   * {repo_license}
   */