YARA

YARA Files & memory · VirusTotal

Pattern-matching language for identifying and classifying malware. A rule combines text, hex and regex strings with a boolean condition, and is run against files, processes or memory dumps.

Suricata

SURICATA Network · OISF

Signatures for the Suricata network IDS/IPS engine. Each rule has an action, a header (protocol, addresses, ports, direction) and options that inspect packets, flows and application-layer protocols.

Sagan

SAGAN Logs & SIEM · Quadrant Information Security

Rules for the Sagan real-time log analysis engine. The grammar is close to Suricata's, but rules match log lines (syslog, …) instead of network packets.

Sigma

SIGMA Logs & SIEM · SigmaHQ

Generic, vendor-neutral signature format for log events, written in YAML. A Sigma rule describes suspicious log entries once and is converted into the query language of any SIEM (Splunk, Elastic, Microsoft Sentinel, …).

Splunk SPL

SPLUNK Logs & SIEM · Splunk

Searches written in Splunk's Search Processing Language, used as correlation searches and detections in Splunk Enterprise Security.

Elastic

ELASTIC Logs & SIEM · Elastic

Detection rules for Elastic Security, stored as TOML with an EQL, KQL, Lucene or ES|QL query that runs against an Elasticsearch cluster.

KQL

KQL Logs & SIEM · Microsoft

Kusto Query Language queries, used as hunting and analytics rules in Microsoft Sentinel, Microsoft Defender XDR and Azure Data Explorer.

Plum Island

PLUM Internet scanning · D4 Project (CIRCL)

Queries ("antibodies") matched against Plum Island's own Internet-scan index to spot exposed or compromised services.

ATR

ATR AI agents · Agent Threat Rules project

Agent Threat Rules: an open YAML detection format for threats against AI agents — prompt injection, tool poisoning, skill compromise, context exfiltration and more, each rule identified as ATR-YYYY-NNNNN.

Nmap NSE

NSE Scanning · Nmap Project

Lua scripts for the Nmap Scripting Engine, used to detect services, vulnerabilities and misconfigurations while scanning hosts.

OWASP CRS

CRS Web application · OWASP

OWASP Core Rule Set: generic attack-detection rules for web application firewalls compatible with ModSecurity (ModSecurity, Coraza, …), covering SQL injection, XSS, remote code execution and more.

Kunai

KUNAI Endpoint (Linux) · Kunai Project

YAML detection and filtering rules for Kunai, an eBPF-based Linux threat-hunting agent that records process, file and network events.

NOVA

NOVA AI / LLM prompts · NOVA Framework

Prompt pattern-matching rules for hunting malicious or abusive prompts sent to LLMs, combining keyword, semantic and LLM-based matching in a YARA-like syntax.

Wazuh

WAZUH Logs & SIEM · Wazuh

XML rules for the Wazuh XDR/SIEM platform. Rules match decoded log events and raise alerts with a level, groups and compliance mappings.

Zeek

ZEEK Network · Zeek Project

Scripts and signatures for the Zeek network security monitor, which turns traffic into rich, structured logs and lets detections react to network events.

Rules whose format isn't one of the above — kept on Rulezet as plain text, without format-specific validation.